CVE-2022-26866

MEDIUM Year: 2022
CVSS v3 Score
5.5
Medium
CVSS v2 Score
3.5
Low
Weakness Type
CWE-79
View all →

Vulnerability Description

Dell PowerStore Versions before v2.1.1.0. contains a Stored Cross-Site Scripting vulnerability. A high privileged network attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.

Related Vulnerabilities

CVE-2016-4790

MEDIUM
CVSS:5.5(Medium)

Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote ...

CWE-792016

CVE-2016-5265

MEDIUM
CVSS:5.5(Medium)

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by...

CWE-792016

CVE-2018-0719

MEDIUM
CVSS:5.5(Medium)

Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on bu...

CWE-792018

CVE-2018-20244

MEDIUM
CVSS:5.5(Medium)

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

CWE-792018

CVE-2018-6681

MEDIUM
CVSS:5.5(Medium)

Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in th...

CWE-792018

CVE-2019-12667

MEDIUM
CVSS:5.5(Medium)

A vulnerability in the web framework code of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interfa...

CWE-792019