ByteOS

Product

PaperCut NG, PaperCut MF

Platforms

MacOS
Linux
Windows

Default Status

affected

Versions

Affected

From 0 before 23.0.7 (custom)
- -> unaffectedfrom23.0.7
From 0 before 22.1.5 (custom)
- -> unaffectedfrom22.1.5
From 0 before 21.2.14 (custom)
- -> unaffectedfrom21.2.14
From 0 before 20.1.10 (custom)
- -> unaffectedfrom20.1.10

Problem Types

Type	CWE ID	Description
CWE	CWE-76	CWE-76 Improper Neutralization of Equivalent Special Elements

Type: CWE

CWE ID: CWE-76

Description: CWE-76 Improper Neutralization of Equivalent Special Elements

Metrics

Version	Base score	Base severity	Vector
3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Impacts

CAPEC ID	Description
CAPEC-63	CAPEC-63 Cross-Site Scripting (XSS)

CAPEC ID: CAPEC-63

Description: CAPEC-63 Cross-Site Scripting (XSS)

References

Hyperlink	Resource
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024	N/A

Hyperlink: https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CISA ADP Vulnrichment

Metrics Other Info

2. CVE Program Container

References

Hyperlink	Resource
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024	x_transferred

Hyperlink: https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Resource:

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:eb41dac7-0af8-4f84-9f6d-0272772514f4

Published At:14 Mar, 2024 | 04:15

Updated At:23 Jan, 2025 | 21:06

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Type: Primary

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CPE Matches

>>papercut_mf>>Versions before 20.1.10(exclusive)

>>papercut_mf>>Versions from 21.0.0(inclusive) to 21.2.14(exclusive)

>>papercut_mf>>Versions from 22.0.0(inclusive) to 22.1.5(exclusive)

>>papercut_mf>>Versions from 23.0.1(inclusive) to 23.0.7(exclusive)

>>papercut_ng>>Versions before 20.1.10(exclusive)

>>papercut_ng>>Versions from 21.0.0(inclusive) to 21.2.14(exclusive)

>>papercut_ng>>Versions from 22.0.0(inclusive) to 22.1.5(exclusive)

>>papercut_ng>>Versions from 23.0.1(inclusive) to 23.0.7(exclusive)

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

Apple Inc.

>>macos>>-

Linux Kernel Organization, Inc

>>linux_kernel>>-

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows>>-

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-76	Secondary	eb41dac7-0af8-4f84-9f6d-0272772514f4
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-76

Type: Secondary

Source: eb41dac7-0af8-4f84-9f6d-0272772514f4

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024	eb41dac7-0af8-4f84-9f6d-0272772514f4	Vendor Advisory
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory

Hyperlink: https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Source: eb41dac7-0af8-4f84-9f6d-0272772514f4

Resource:

Vendor Advisory

Hyperlink: https://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Similar CVEs

11568Records found

CVE-2021-40457

Matching Score-10

Matching Score-10

CVSS Score-7.4||HIGH

EPSS-1.54% / 72.39%

7 Day CHG~0.00%

Published-13 Oct, 2021 | 00:26

Updated-04 Aug, 2024 | 02:44

Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability

Product-dynamics_365 Microsoft Dynamics 365 Customer Engagement V9.1 Microsoft Dynamics 365 Customer Engagement V9.0

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-38896

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.63% / 46.54%

7 Day CHG~0.00%

Published-20 Oct, 2021 | 18:35

Updated-16 Sep, 2024 | 19:14

IBM QRadar Advisor 2.5 through 2.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209566.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel qradar_advisor Qradar Advisor

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-38927

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-7.2||HIGH

EPSS-0.34% / 26.69%

7 Day CHG~0.00%

Published-25 Dec, 2023 | 02:20

Updated-04 Aug, 2024 | 01:51

IBM Aspera Console cross-site scripting

IBM Aspera Console 3.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 210322.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-windows linux_kernel aspera_console Aspera Console

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0767

Matching Score-10

Matching Score-10

Vendor-n/a Microsoft Corporation Oracle Corporation Adobe Inc.Apple Inc.Linux Kernel Organization, Inc Google LLC

CVSS Score-6.1||MEDIUM

EPSS-6.66% / 93.18%

7 Day CHG~0.00%

Published-16 Feb, 2012 | 19:00

Updated-21 Apr, 2026 | 21:13

Known KEV||Action Due Date - 2022-06-22||The impacted product is end-of-life and should be disconnected if still in use.

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.

Product-mac_os_x solaris windows flash_player android linux_kernel n/a Flash Player

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-29345

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.19% / 64.68%

7 Day CHG~0.00%

Published-07 Jun, 2023 | 17:48

Updated-01 Jan, 2025 | 02:15

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Product-edge_chromium Microsoft Edge (Chromium-based)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-5069

Matching Score-10

Assigner-Chrome

Product-enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop windows macos chrome android linux_kernel Google Chrome prior to 58.0.3029.81 for Linux, Windows and Mac, and 58.0.3029.83 for Android

Matching Score-10

Assigner-Chrome

CVSS Score-6.1||MEDIUM

EPSS-1.18% / 64.39%

7 Day CHG~0.00%

Published-27 Oct, 2017 | 05:00

Updated-13 May, 2026 | 00:24

Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Red Hat, Inc.Microsoft Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-42897

Matching Score-10

Matching Score-10

CVSS Score-8.1||HIGH

EPSS-5.64% / 92.13%

7 Day CHG~0.00%

Published-14 May, 2026 | 17:00

Updated-19 Jun, 2026 | 16:12

Known KEV||Action Due Date - 2026-05-29||Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Microsoft Exchange Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Product-exchange_server exchange_server_subscription_edition Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 15 Microsoft Exchange Server 2019 Cumulative Update 14 Microsoft Exchange Server Subscription Edition RTM Microsoft

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-30744

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-1.07% / 61.27%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 13:44

Updated-03 Aug, 2024 | 22:40

Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site scripting.

Vendor-Apple Inc.

Product-iphone_os watchos ipados tvos safari macos macOS iOS and iPadOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-30689

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-1.10% / 62.38%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 14:29

Updated-03 Aug, 2024 | 22:40

A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site scripting.

Vendor-Apple Inc.

Product-iphone_os watchos ipados tvos safari macos macOS iOS and iPadOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-28459

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-2.32% / 81.64%

7 Day CHG~0.00%

Published-13 Apr, 2021 | 19:33

Updated-03 Aug, 2024 | 21:40

Azure DevOps Server Spoofing Vulnerability

Product-azure_devops_server Azure DevOps Server 2020.0.1

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-29849

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.62% / 45.85%

7 Day CHG~0.00%

Published-01 Dec, 2021 | 17:05

Updated-17 Sep, 2024 | 00:25

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205281.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-qradar_security_information_and_event_manager linux_kernel QRadar SIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-28314

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-0.67% / 48.33%

7 Day CHG~0.00%

Published-11 Apr, 2023 | 19:13

Updated-28 Feb, 2025 | 20:03

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Product-dynamics_365 Microsoft Dynamics 365 (on-premises) version 9.0 Microsoft Dynamics 365 (on-premises) version 9.1

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-29712

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.65% / 47.47%

7 Day CHG~0.00%

Published-09 Jul, 2021 | 16:55

Updated-16 Sep, 2024 | 16:18

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 200966.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix windows infosphere_information_server linux_kernel InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1252

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-13.97% / 96.16%

7 Day CHG~0.00%

Published-16 Jun, 2011 | 20:21

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified strings, aka "toStaticHTML Information Disclosure Vulnerability" or "HTML Sanitization Vulnerability."

Product-internet_explorer windows_7 windows_server_2008 windows_vista windows_xp windows_2003_server windows_server_2003 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0096

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-46.82% / 98.70%

7 Day CHG~0.00%

Published-31 Jan, 2011 | 19:00

Updated-29 Apr, 2026 | 01:13

The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability."

Product-windows_7 windows_server_2008 windows_vista windows_xp windows_2003_server windows_server_2003 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-8758

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-3.38% / 87.54%

7 Day CHG~0.00%

Published-13 Sep, 2017 | 01:00

Updated-13 May, 2026 | 00:24

Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability."

Product-exchange_server Microsoft Exchange Server 2016

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-1825

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-1.36% / 68.78%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 14:55

Updated-03 Aug, 2024 | 16:25

An input validation issue was addressed with improved input validation. This issue is fixed in iTunes 12.11.3 for Windows, iCloud for Windows 12.3, macOS Big Sur 11.3, Safari 14.1, watchOS 7.4, tvOS 14.5, iOS 14.5 and iPadOS 14.5. Processing maliciously crafted web content may lead to a cross site scripting attack.

Vendor-Apple Inc.

Product-itunes iphone_os ipados tvos watchos safari macos icloud iTunes for Windows watchOS iCloud for Windows Safari macOS tvOS iOS and iPadOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-20444

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.66% / 47.82%

7 Day CHG~0.00%

Published-18 Feb, 2021 | 15:10

Updated-16 Sep, 2024 | 17:23

IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196620.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-windows maximo_for_civil_infrastructure linux_kernel Maximo for Civil Infrastructure

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-1879

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-7.08% / 93.55%

7 Day CHG~0.00%

Published-02 Apr, 2021 | 18:07

Updated-23 Oct, 2025 | 18:01

Known KEV||Action Due Date - 2021-11-17||Apply updates per vendor instructions.

This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited..

Vendor-Apple Inc.

Product-ipados iphone_os watchos iOS watchOS iOS and iPadOS iOS, iPadOS, and watchOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-1826

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-1.06% / 61.05%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 14:56

Updated-03 Aug, 2024 | 16:25

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may lead to universal cross site scripting.

Vendor-Apple Inc.

Product-iphone_os watchos tvos ipados macos tvOS macOS watchOS iOS and iPadOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-5045

Matching Score-10

Assigner-Chrome

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Red Hat, Inc.Microsoft Corporation Debian GNU/Linux

Matching Score-10

Assigner-Chrome

CVSS Score-6.1||MEDIUM

EPSS-1.22% / 65.65%

7 Day CHG~0.00%

Published-24 Apr, 2017 | 23:00

Updated-13 May, 2026 | 00:24

XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load, which allowed a remote attacker to brute force JavaScript variables via a crafted HTML page.

Product-debian_linux enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop windows macos chrome android linux_kernel Google Chrome prior to 57.0.2987.98 for Mac, Windows and Linux, and 57.0.2987.108 for Android

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-9995

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.59% / 44.61%

7 Day CHG~0.00%

Published-02 Apr, 2021 | 17:25

Updated-04 Aug, 2024 | 10:50

An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Server 5.11. Processing a maliciously crafted URL may lead to an open redirect or cross site scripting.

Vendor-Apple Inc.

Product-macos_server macOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

CVE-2020-9925

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-1.14% / 63.16%

7 Day CHG~0.00%

Published-16 Oct, 2020 | 16:49

Updated-04 Aug, 2024 | 10:43

A logic issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing maliciously crafted web content may lead to universal cross site scripting.

Vendor-Apple Inc.

Product-itunes iphone_os watchos ipados tvos safari icloud iTunes for Windows watchOS iCloud for Windows Safari iOS iCloud for Windows (Legacy)tvOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-8514

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.81% / 53.18%

7 Day CHG~0.00%

Published-02 Feb, 2020 | 14:06

Updated-04 Aug, 2024 | 10:03

An issue was discovered in Rumpus 8.2.10 on macOS. By crafting a directory name, it is possible to activate JavaScript in the context of the web application after invoking the rename folder functionality.

Vendor-maxum n/a Apple Inc.

Product-rumpus macos n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-28313

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-0.69% / 48.78%

7 Day CHG~0.00%

Published-11 Apr, 2023 | 19:13

Updated-28 Feb, 2025 | 20:03

Microsoft Dynamics 365 Customer Voice Cross-Site Scripting Vulnerability

Product-send_customer_voice_survey_from_dynamics_365 Send Customer Voice survey from Dynamics 365

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-0030

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-7.61% / 93.92%

7 Day CHG~0.00%

Published-13 Jan, 2016 | 02:00

Updated-06 May, 2026 | 22:30

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-0029

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-7.61% / 93.92%

7 Day CHG~0.00%

Published-13 Jan, 2016 | 02:00

Updated-06 May, 2026 | 22:30

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031.

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-0031

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-7.68% / 93.96%

7 Day CHG~0.00%

Published-13 Jan, 2016 | 02:00

Updated-06 May, 2026 | 22:30

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-7140

Matching Score-10

Assigner-Hewlett Packard Enterprise (HPE)

Matching Score-10

Assigner-Hewlett Packard Enterprise (HPE)

CVSS Score-6.1||MEDIUM

EPSS-0.76% / 51.55%

7 Day CHG~0.00%

Published-08 Jul, 2020 | 13:39

Updated-04 Aug, 2024 | 09:18

A security vulnerability in HPE IceWall SSO Dfw and Dgfw (Domain Gateway Option) could be exploited remotely to cause a remote cross-site scripting (XSS). HPE has provided the following information to resolve this vulnerability in HPE IceWall SSO DFW and Dgfw: https://www.hpe.com/jp/icewall_patchaccess

Vendor-n/a Microsoft Corporation HP Inc.Red Hat, Inc.

Product-icewall_sso_dgfw windows icewall_sso_dfw enterprise_linux IceWall SSO Dfw; IceWall SSO Dgfw

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-4973

Matching Score-10

Assigner-VulDB

Matching Score-10

Assigner-VulDB

CVSS Score-3.5||LOW

EPSS-1.84% / 76.68%

7 Day CHG~0.00%

Published-15 Sep, 2023 | 02:00

Updated-02 Aug, 2024 | 07:44

Academy LMS GET Parameter filter cross site scripting

A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely. The identifier VDB-239749 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Vendor-Creativeitem Microsoft Corporation

Product-academy_lms windows LMS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-1299

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.81% / 53.05%

7 Day CHG~0.00%

Published-12 Mar, 2008 | 17:00

Updated-23 Apr, 2026 | 00:35

Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Vendor-n/a Microsoft Corporation ManageEngine (Zoho Corporation Pvt. Ltd.)

Product-windows servicedesk_plus n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-13702

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.21% / 11.57%

7 Day CHG~0.00%

Published-13 Mar, 2026 | 18:33

Updated-10 May, 2026 | 14:16

IBM Sterling Partner Engagement Manager Cross-Site Scripting

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-sterling_partner_engagement_manager linux_kernel Sterling Partner Engagement Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-58643

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 14.46%

7 Day CHG~0.00%

Published-16 Jul, 2026 | 21:57

Updated-24 Jul, 2026 | 19:31

Windows Admin Center Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network.

Product-windows_admin_center Windows Admin Center

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-58298

Matching Score-10

Matching Score-10

CVSS Score-7.2||HIGH

EPSS-0.24% / 15.12%

7 Day CHG~0.00%

Published-03 Jul, 2026 | 20:35

Updated-24 Jul, 2026 | 19:36

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Product-edge_chromium Microsoft Edge (Chromium-based)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-3902

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-1.12% / 62.88%

7 Day CHG~0.00%

Published-01 Apr, 2020 | 17:51

Updated-04 Aug, 2024 | 07:52

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Processing maliciously crafted web content may lead to a cross site scripting attack.

Vendor-Apple Inc.

Product-itunes iphone_os ipad_os tvos safari icloud iTunes for Windows iCloud for Windows Safari iOS iCloud for Windows (Legacy)tvOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-4657

Matching Score-10

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.72% / 50.11%

7 Day CHG~0.00%

Published-16 Dec, 2020 | 20:35

Updated-17 Sep, 2024 | 01:52

IBM Sterling B2B Integrator 5.2.0.0 through 6.0.3.2 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186094.

Product-sterling_b2b_integrator solaris linux_kernel i hp-ux windows aix Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-4183

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.73% / 50.44%

7 Day CHG~0.00%

Published-04 Jun, 2020 | 13:35

Updated-16 Sep, 2024 | 17:27

IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174739.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel security_guardium Security Guardium

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-36486

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.70% / 49.41%

7 Day CHG~0.00%

Published-22 Oct, 2021 | 19:20

Updated-04 Aug, 2024 | 17:30

Swift File Transfer Mobile v1.1.2 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the 'path' parameter of the 'list' and 'download' exception-handling.

Vendor-swiftfiletransfer n/a BlackBerry Limited Apple Inc.Google LLC

Product-android iphone_os blackberry_os swift_file_transfer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-3867

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-1.39% / 69.37%

7 Day CHG~0.00%

Published-27 Feb, 2020 | 20:45

Updated-04 Aug, 2024 | 07:44

A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted web content may lead to universal cross site scripting.

Vendor-webkitgtk openSUSE Apple Inc.

Product-itunes iphone_os ipados tvos safari webkitgtk icloud leap iTunes for Windows iCloud for Windows Safari iOS iCloud for Windows (Legacy)tvOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-57101

Matching Score-10

Matching Score-10

CVSS Score-7.1||HIGH

EPSS-0.44% / 36.08%

7 Day CHG+0.02%

Published-14 Jul, 2026 | 17:09

Updated-24 Jul, 2026 | 19:35

Visual Studio Code Security Feature Bypass Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Product-visual_studio_code Visual Studio Code

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-35753

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.93% / 56.98%

7 Day CHG~0.00%

Published-22 Jan, 2021 | 03:40

Updated-04 Aug, 2024 | 17:09

The job posting recommendation form in Persis Human Resource Management Portal (Versions 17.2.00 through 17.2.35 and 19.0.00 through 19.0.20), when the "Recommend job posting" function is enabled, allows XSS via the SENDER parameter.

Vendor-persis n/a Linux Kernel Organization, Inc Microsoft Corporation

Product-human_resource_management_portal windows linux_kernel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-33113

Matching Score-10

Matching Score-10

CVSS Score-5.4||MEDIUM

EPSS-0.52% / 41.13%

7 Day CHG~0.00%

Published-09 Jun, 2026 | 17:05

Updated-23 Jul, 2026 | 08:10

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Product-sharepoint_server Microsoft SharePoint Server Subscription Edition Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server 2019

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-0032

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-7.61% / 93.92%

7 Day CHG~0.00%

Published-13 Jan, 2016 | 02:00

Updated-06 May, 2026 | 22:30

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-34614

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-0.19% / 8.48%

7 Day CHG~0.00%

Published-14 Apr, 2026 | 17:33

Updated-24 Jul, 2026 | 22:10

Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.

Vendor-Microsoft Corporation Adobe Inc.Apple Inc.

Product-connect windows connect_desktop_application macos Adobe Connect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-33138

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.22% / 12.42%

7 Day CHG~0.00%

Published-22 May, 2025 | 16:37

Updated-26 Aug, 2025 | 15:04

IBM Aspera Faspex HTML injection

IBM Aspera Faspex 5.0.0 through 5.0.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel aspera_faspex Aspera Faspex

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-49349

Matching Score-10

Assigner-IBM Corporation

Product-linux_kernel linux_on_ibm_z aix financial_transaction_manager_for_multiplatform Financial Transaction Manager for SWIFT Services for Multiplatforms

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.22% / 12.19%

7 Day CHG~0.00%

Published-31 Jan, 2025 | 16:14

Updated-13 Aug, 2025 | 17:34

IBM Financial Transaction Manager cross-site scripting

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.1 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-Linux Kernel Organization, Inc IBM Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-26870

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-4.88% / 91.15%

7 Day CHG~0.00%

Published-07 Oct, 2020 | 15:50

Updated-04 Aug, 2024 | 16:03

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.

Vendor-cure53 n/a Microsoft Corporation Oracle Corporation Debian GNU/Linux

Product-application_express debian_linux visual_studio_2019 dompurify visual_studio_2017 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-25841

Matching Score-10

Assigner-Environmental Systems Research Institute, Inc.

Vendor-Microsoft Corporation Linux Kernel Organization, Inc Environmental Systems Research Institute, Inc. ("Esri")

Matching Score-10

Assigner-Environmental Systems Research Institute, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.64% / 46.72%

7 Day CHG+0.12%

Published-21 Jul, 2023 | 18:38

Updated-10 Apr, 2025 | 19:15

BUG-000158075 Stored XSS issue in ArcGIS Server

There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities.

Product-linux_kernel arcgis_server windows ArcGIS Enterprise Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-21264

Matching Score-10

Matching Score-10

CVSS Score-9.3||CRITICAL

EPSS-0.37% / 29.53%

7 Day CHG~0.00%

Published-22 Jan, 2026 | 22:47

Updated-01 Apr, 2026 | 13:49

Microsoft Account Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing over a network.

Product-account Microsoft Account

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-41746

Matching Score-10

Assigner-IBM Corporation