CVE-2019-16149

MEDIUM Year: 2019
CVSS v3 Score
5.5
Medium
Weakness Type
CWE-79
View all →

Vulnerability Description

An Improper Neutralization of Input During Web Page Generation in FortiClientEMS version 6.2.0 may allow a remote attacker to execute unauthorized code by injecting malicious payload in the user profile of a FortiClient instance being managed by the vulnerable system.

Related Vulnerabilities

CVE-2016-4790

MEDIUM
CVSS:5.5(Medium)

Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote ...

CWE-792016

CVE-2016-5265

MEDIUM
CVSS:5.5(Medium)

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by...

CWE-792016

CVE-2018-0719

MEDIUM
CVSS:5.5(Medium)

Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on bu...

CWE-792018

CVE-2018-20244

MEDIUM
CVSS:5.5(Medium)

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

CWE-792018

CVE-2018-6681

MEDIUM
CVSS:5.5(Medium)

Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in th...

CWE-792018

CVE-2019-12667

MEDIUM
CVSS:5.5(Medium)

A vulnerability in the web framework code of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interfa...

CWE-792019