ByteOS

Microsoft SharePoint Enterprise Server 2016

Product

Platforms

x64-based Systems

Versions

Affected

From 16.0.0 before 16.0.5483.1001 (custom)

Vendor

Microsoft SharePoint Server 2019

Product

Platforms

x64-based Systems

Versions

Affected

From 16.0.0 before 16.0.10416.20041 (custom)

Vendor

Microsoft SharePoint Server Subscription Edition

Product

Platforms

x64-based Systems

Versions

Affected

From 16.0.0 before 16.0.17928.20356 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C

References

Hyperlink	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21393	vendor-advisory

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21393

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:14 Jan, 2025 | 18:16

Updated At:17 Jan, 2025 | 15:45

Microsoft SharePoint Server Spoofing Vulnerability

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Primary	3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Type: Primary

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

CPE Matches

cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*

>>sharepoint_server>>Versions before 16.0.17928.20356(exclusive)

cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*

>>sharepoint_server>>2016

cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*

>>sharepoint_server>>2019

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	secure@microsoft.com
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Secondary

Source: secure@microsoft.com

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21393	secure@microsoft.com	Patch Vendor Advisory

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21393

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Similar CVEs

686Records found

CVE-2023-33132

Matching Score-10

Matching Score-10

CVSS Score-6.3||MEDIUM

EPSS-0.28% / 51.11%

7 Day CHG~0.00%

Published-13 Jun, 2023 | 23:26

Updated-28 Feb, 2025 | 20:02

Microsoft SharePoint Server Spoofing Vulnerability

Product-sharepoint_server Microsoft SharePoint Server 2019 Microsoft SharePoint Server Subscription Edition

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1570

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-3.5||LOW

EPSS-0.65% / 69.78%

7 Day CHG~0.00%

Published-07 May, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.

Vendor-n/a Liferay Inc.Microsoft Corporation

Product-windows_7 liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1578

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.70% / 71.03%

7 Day CHG~0.00%

Published-27 Apr, 2011 | 00:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character.

Vendor-n/a Wikimedia Foundation Microsoft Corporation

Product-mediawiki internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1587

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.26% / 48.76%

7 Day CHG~0.00%

Published-27 Apr, 2011 | 00:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578.

Vendor-n/a Wikimedia Foundation Microsoft Corporation

Product-mediawiki internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1765

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.43% / 61.73%

7 Day CHG~0.00%

Published-23 May, 2011 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .shtml at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578 and CVE-2011-1587.

Vendor-n/a Wikimedia Foundation Microsoft Corporation

Product-mediawiki internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1252

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-20.85% / 95.40%

7 Day CHG~0.00%

Published-16 Jun, 2011 | 20:21

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified strings, aka "toStaticHTML Information Disclosure Vulnerability" or "HTML Sanitization Vulnerability."

Product-windows_7 windows_xp windows_server_2008 windows_server_2003 windows_2003_server windows_vista internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1897

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-15.11% / 94.33%

7 Day CHG~0.00%

Published-12 Oct, 2011 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Default Reflected XSS Vulnerability."

Product-forefront_unified_access_gateway n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-0011

Matching Score-6

Matching Score-6

CVSS Score-5.4||MEDIUM

EPSS-1.37% / 79.47%

7 Day CHG~0.00%

Published-13 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-2015-6117.

Product-sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0653

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-47.88% / 97.64%

7 Day CHG~0.00%

Published-15 Sep, 2011 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2010 Gold and SP1, and SharePoint Foundation 2010, allows remote attackers to inject arbitrary web script or HTML via the URI, aka "XSS in SharePoint Calendar Vulnerability."

Product-sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-19916

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.31% / 53.91%

7 Day CHG~0.00%

Published-20 Dec, 2019 | 15:07

Updated-05 Aug, 2024 | 02:32

In Midori Browser 0.5.11 (on Windows 10), Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the multipart/x-mixed-replace MIME type. This could result in script running where CSP should have blocked it, allowing for cross-site scripting (XSS) and other attacks when the product renders the content as HTML. Remediating this would also need to consider the polyglot case, e.g., a file that is a valid GIF image and also valid JavaScript.

Vendor-midori-browser n/a Microsoft Corporation

Product-midori windows_10 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-4114

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.67% / 70.39%

7 Day CHG~0.00%

Published-22 Dec, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Discovery & Dependency Mapping Inventory (DDMI) 2.5x, 7.5x, and 7.6x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-windows discovery\&dependency_mapping_inventory n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-0955

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-0.33% / 55.58%

7 Day CHG~0.00%

Published-10 Feb, 2016 | 20:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Experience Manager (AEM) 6.1.0 allows remote authenticated users to inject arbitrary web script or HTML via a folder title field that is mishandled in the Deletion popup dialog.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-windows linux_kernel mac_os_x experience_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-4111

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.61% / 68.94%

7 Day CHG~0.00%

Published-22 Dec, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Insight Diagnostics Online Edition before 8.5.1.3712 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation Linux Kernel Organization, Inc

Product-linux_kernel windows insight_diagnostics n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-0032

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-1.47% / 80.11%

7 Day CHG~0.00%

Published-13 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-35642

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.20% / 42.60%

7 Day CHG~0.00%

Published-03 Nov, 2022 | 00:00

Updated-02 May, 2025 | 21:15

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592."

Vendor-n/a IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-aix infosphere_information_server windows linux_kernel IBM InfoSphere Information Server

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-3936

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-42.35% / 97.36%

7 Day CHG~0.00%

Published-10 Nov, 2010 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Signurl.asp in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS in Signurl.asp Vulnerability."

Product-forefront_unified_access_gateway n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-3985

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.85% / 73.98%

7 Day CHG~0.00%

Published-26 Oct, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Operations Orchestration before 9.0, when Internet Explorer 6.0 is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-operations_orchestration internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2429

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.28% / 50.77%

7 Day CHG~0.00%

Published-23 Jun, 2010 | 17:13

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.1.2, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer in a "404 Not Found" response.

Vendor-n/a Splunk LLC (Cisco Systems, Inc.)Microsoft Corporation

Product-splunk internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2091

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-5.71% / 90.07%

7 Day CHG~0.00%

Published-27 May, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via an invalid value.

Product-windows_server_2003 exchange_server internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2265

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-44.19% / 97.46%

7 Day CHG~0.00%

Published-14 Jun, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windows XP and Windows Server 2003 allows remote attackers to inject arbitrary web script or HTML via the svr parameter to sysinfo/sysinfomain.htm. NOTE: this can be leveraged with CVE-2010-1885 to execute arbitrary commands without user interaction.

Product-windows_server_2003 windows_xp windows_2003_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2085

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-11.94% / 93.50%

7 Day CHG~0.00%

Published-27 May, 2010 | 18:32

Updated-11 Apr, 2025 | 00:51

The default configuration of ASP.NET in Microsoft .NET before 1.1 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the __VIEWSTATE parameter.

Product-.net_framework n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2665

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.68% / 70.71%

7 Day CHG~0.00%

Published-07 Jul, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Opera before 10.54 on Windows and Mac OS X, and before 10.11 on UNIX platforms, allows remote attackers to inject arbitrary web script or HTML via a data: URI, related to incorrect detection of the "opening site."

Vendor-unix n/a Microsoft Corporation Apple Inc.Opera

Product-windows opera_browser mac_os_x unix n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1489

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-22.05% / 95.57%

7 Day CHG~0.00%

Published-20 Apr, 2010 | 16:00

Updated-11 Apr, 2025 | 00:51

The XSS Filter in Microsoft Internet Explorer 8 does not properly perform neutering for the SCRIPT tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks against web sites that have no inherent XSS vulnerabilities, a different issue than CVE-2009-4074.

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1394

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.20% / 78.04%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML document fragments.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1762

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.91% / 74.86%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1257

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-44.93% / 97.50%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.

Product-sharepoint_services windows_7 sharepoint_server windows_xp office_infopath windows_server_2008 windows_2003_server windows_vista internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1420

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.24% / 46.90%

7 Day CHG~0.00%

Published-21 Jul, 2011 | 23:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in CFNetwork in Apple Safari before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via a crafted text/plain file.

Product-windows_7 cfnetwork windows_xp windows_vista safari n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6061

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-14.16% / 94.11%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject arbitrary web script or HTML via an instant-message session, aka "Server Input Validation Information Disclosure Vulnerability."

Product-skype_for_business lync_room_system lync n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1418

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.20% / 78.07%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1389

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.01% / 76.14%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a (1) paste or (2) drag-and-drop operation for a selection.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-0716

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-8.27% / 91.91%

7 Day CHG~0.00%

Published-26 Feb, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

_layouts/Upload.aspx in the Documents module in Microsoft SharePoint before 2010 uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading TXT files, a related issue to CVE-2008-5026. NOTE: the vendor disputes the significance of this issue, because cross-domain isolation can be implemented when needed.

Product-sharepoint_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6123

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-12.05% / 93.53%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Excel for Mac 2011 and Excel 2016 for Mac allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message that is mishandled by Outlook for Mac, aka "Microsoft Outlook for Mac Spoofing Vulnerability."

Product-excel_for_mac n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-5159

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.77% / 72.60%

7 Day CHG~0.00%

Published-13 Mar, 2020 | 14:20

Updated-07 Aug, 2024 | 07:32

Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment.

Vendor-invisioncommunity n/a Microsoft Corporation

Product-invision_power_board internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2379

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.44% / 62.36%

7 Day CHG~0.00%

Published-09 Aug, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3, when Internet Explorer before 9 or Safari before 5.0.6 is used for Raw Unified mode, allows remote attackers to inject arbitrary web script or HTML via a crafted patch, related to content sniffing.

Vendor-n/a Mozilla Corporation Microsoft Corporation Apple Inc.

Product-bugzilla safari internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6039

Matching Score-6

Matching Score-6

CVSS Score-3.5||LOW

EPSS-9.02% / 92.29%

7 Day CHG~0.00%

Published-14 Oct, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via crafted content in an Office Marketplace instance, aka "Microsoft SharePoint Security Feature Bypass Vulnerability."

Product-sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6138

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-24.02% / 95.82%

7 Day CHG~0.00%

Published-09 Dec, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Microsoft Internet Explorer 8 through 11 mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Internet Explorer XSS Filter Bypass Vulnerability."

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6058

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-18.96% / 95.08%

7 Day CHG~0.00%

Published-14 Oct, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Microsoft Edge XSS Filter Bypass."

Product-edge n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6099

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-25.18% / 95.97%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in ASP.NET in Microsoft .NET Framework 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka ".NET Elevation of Privilege Vulnerability."

Product-.net_framework n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6144

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-24.12% / 95.85%

7 Day CHG~0.00%

Published-09 Dec, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Microsoft Internet Explorer 8 through 11 and Microsoft Edge mishandle HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Microsoft Browser XSS Filter Bypass Vulnerability."

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-0544

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.76% / 72.43%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-0190

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-1.39% / 79.59%

7 Day CHG~0.00%

Published-14 Apr, 2010 | 15:44

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-1305

Matching Score-6

Matching Score-6

CVSS Score-5.4||MEDIUM

EPSS-0.72% / 71.54%

7 Day CHG~0.00%

Published-11 Sep, 2019 | 21:25

Updated-04 Aug, 2024 | 18:13

A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'.

Product-azure_devops_server team_foundation_server Team Foundation Server 2015 Azure DevOps Server Team Foundation Server 2018 Team Foundation Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-4804

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.31% / 53.56%

7 Day CHG~0.00%

Published-23 Apr, 2010 | 14:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the Calendar Base (cal) extension before 1.1.1 for TYPO3, when Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via "search parameters."

Vendor-mario_matzulla n/a TYPO3 Association Microsoft Corporation

Product-calendar_base typo3 internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-4040

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 54.61%

7 Day CHG~0.00%

Published-20 Nov, 2009 | 19:00

Updated-16 Sep, 2024 | 16:23

Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.0.17 and 2.5.x before 2.5.2, when used with Internet Explorer 6 or 7, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the search page.

Vendor-n/a Thorsten Rinne (phpMyFAQ)Microsoft Corporation

Product-internet_explorer phpmyfaq n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-4070

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-18.34% / 94.97%

7 Day CHG~0.00%

Published-10 Sep, 2014 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync XSS Information Disclosure Vulnerability."

Product-lync_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-1332

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-2.05% / 83.14%

7 Day CHG~0.00%

Published-10 Dec, 2019 | 21:40

Updated-04 Aug, 2024 | 18:13

A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web request to an affected SSRS server, aka 'Microsoft SQL Server Reporting Services XSS Vulnerability'.

Product-sql_server_2019_reporting_services sql_server_2017_reporting_services power_bi_report_server SQL Server 2019 Reporting Services SQL Server 2017 Reporting Services Power BI Report Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-1218

Matching Score-6

Matching Score-6

CVSS Score-5.4||MEDIUM

EPSS-8.98% / 92.27%

7 Day CHG~0.00%

Published-14 Aug, 2019 | 20:55

Updated-04 Aug, 2024 | 18:13

Outlook iOS Spoofing Vulnerability

A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user. The security update addresses the vulnerability by correcting how Outlook iOS parses specially crafted email messages.

Product-outlook Outlook for iOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-3731

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.20% / 83.73%

7 Day CHG~0.00%

Published-16 Dec, 2009 | 18:00

Updated-07 Aug, 2024 | 06:38

Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

Vendor-webworks n/a VMware (Broadcom Inc.)Microsoft Corporation

Product-publisher epublisher lab_manager esx_server vcenter_lab_manager stage_manager windows server vcenter vcenter_stage_manager help n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-0817

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-49.25% / 97.70%

7 Day CHG~0.00%

Published-29 Apr, 2010 | 21:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services 3.0 SP1 and SP2, versions, allows remote attackers to inject arbitrary web script or HTML via the cid0 parameter.

Product-sharepoint_server sharepoint_services n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-17039

Matching Score-6

Assigner-MITRE Corporation