Total
47475 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-35351 | 1 Dino Physics School Assistant Project | 1 Dino Physics School Assistant | 2026-06-17 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in Diño Physics School Assistant version 2.3. This vulnerability impacts unidentified code within the file /classes/SystemSettings.php?f=update_settings. Manipulating the parameter name results in cross-site scripting. | |||||
| CVE-2024-35345 | 1 Dino Physics School Assistant Project | 1 Dino Physics School Assistant | 2026-06-17 | N/A | 5.4 MEDIUM |
| A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts unidentified code within the file /classes/Users.php. Manipulating the argument id results in cross-site scripting. | |||||
| CVE-2024-35322 | 1 Airc | 1 Mynet | 2026-06-17 | N/A | 6.1 MEDIUM |
| MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter. | |||||
| CVE-2024-35321 | 1 Airc | 1 Mynet | 2026-06-17 | N/A | 4.3 MEDIUM |
| MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter. | |||||
| CVE-2024-35302 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | N/A | 5.4 MEDIUM |
| In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible | |||||
| CVE-2024-35300 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | N/A | 3.5 LOW |
| In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible | |||||
| CVE-2024-35297 | 2026-06-17 | N/A | 4.7 MEDIUM | ||
| Cross-site scripting vulnerability exists in WP Booking versions prior to 2.4.5. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing the web site using the product. | |||||
| CVE-2024-35291 | 2026-06-17 | N/A | 6.1 MEDIUM | ||
| Cross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product. | |||||
| CVE-2024-35284 | 1 Mitel | 1 Micontact Center Business | 2026-06-17 | N/A | 5.4 MEDIUM |
| A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation. | |||||
| CVE-2024-35283 | 1 Mitel | 1 Micontact Center Business | 2026-06-17 | N/A | 6.1 MEDIUM |
| A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-site scripting (XSS) attack due to insufficient input validation. | |||||
| CVE-2024-35280 | 1 Fortinet | 1 Fortideceptor | 2026-06-17 | N/A | 5.4 MEDIUM |
| A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiDeceptor 5.2.0, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions, FortiDeceptor 4.3 all versions, FortiDeceptor 4.2 all versions, FortiDeceptor 4.1 all versions, FortiDeceptor 4.0 all versions, FortiDeceptor 3.3 all versions, FortiDeceptor 3.2 all versions, FortiDeceptor 3.1 all versions, FortiDeceptor 3.0 all versions may allow an attacker to perform a reflected cross-site scripting attack in the recovery endpoints | |||||
| CVE-2024-35267 | 1 Microsoft | 1 Azure Devops Server | 2026-06-17 | N/A | 7.6 HIGH |
| Azure DevOps Server Spoofing Vulnerability | |||||
| CVE-2024-35266 | 1 Microsoft | 1 Azure Devops Server | 2026-06-17 | N/A | 7.6 HIGH |
| Azure DevOps Server Spoofing Vulnerability | |||||
| CVE-2024-35240 | 2026-06-17 | N/A | 5.4 MEDIUM | ||
| Umbraco Commerce is an open source dotnet ecommerce solution. In affected versions there exists a stored Cross-site scripting (XSS) issue which would enable attackers to inject malicious code into Print Functionality. This issue has been addressed in versions 12.1.4, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||
| CVE-2024-35239 | 1 Umbraco | 1 Umbraco Forms | 2026-06-17 | N/A | 2.7 LOW |
| Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13). | |||||
| CVE-2024-35236 | 1 Audiobookshelf | 1 Audiobookshelf | 2026-06-17 | N/A | 4.8 MEDIUM |
| Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Attacking a user with high privileges (upload, creation of libraries) can lead to remote code execution (RCE) in the worst case. This was tested on version 2.9.0 on Windows, but an arbitrary file write is powerful enough as is and should easily lead to RCE on Linux, too. Version 2.10.0 contains a patch for the vulnerability. | |||||
| CVE-2024-35234 | 1 Discourse | 1 Discourse | 2026-06-17 | N/A | 4.2 MEDIUM |
| Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. As a workaround, ensure CSP is enabled on the forum. | |||||
| CVE-2024-35225 | 1 Jupyter | 1 Jupyter Server Proxy | 2026-06-17 | N/A | 9.6 CRITICAL |
| Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting (XSS) issue. The `/proxy` endpoint accepts a `host` path segment in the format `/proxy/<host>`. When this endpoint is called with an invalid `host` value, `jupyter-server-proxy` replies with a response that includes the value of `host`, without sanitization [2]. A third-party actor can leverage this by sending a phishing link with an invalid `host` value containing custom JavaScript to a user. When the user clicks this phishing link, the browser renders the response of `GET /proxy/<host>`, which runs the custom JavaScript contained in `host` set by the actor. As any arbitrary JavaScript can be run after the user clicks on a phishing link, this issue permits extensive access to the user's JupyterLab instance for an actor. Patches are included in versions 4.2.0 and 3.2.4. As a workaround, server operators who are unable to upgrade can disable the `jupyter-server-proxy` extension. | |||||
| CVE-2024-35218 | 1 Umbraco | 1 Umbraco Cms | 2026-06-17 | N/A | 4.2 MEDIUM |
| Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer. | |||||
| CVE-2024-35203 | 1 Mahara | 1 Mahara | 2026-06-17 | N/A | 6.1 MEDIUM |
| Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code as part of its name, that is uploaded via the Mahara filebrowser system. | |||||