CVE-2022-27878

MEDIUM Year: 2022
CVSS v3 Score
6.8
Medium
CVSS v2 Score
6.0
Medium
Weakness Type
CWE-79
View all →

Vulnerability Description

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Related Vulnerabilities

CVE-2019-0308

MEDIUM
CVSS:6.8(Medium)

An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTM...

CWE-792019

CVE-2019-15053

MEDIUM
CVSS:6.8(Medium)

The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element.

CWE-792019

CVE-2020-11001

MEDIUM
CVSS:6.8(Medium)

In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission ...

CWE-792020

CVE-2020-28487

MEDIUM
CVSS:6.8(Medium)

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.

CWE-792020

CVE-2021-3866

MEDIUM
CVSS:6.8(Medium)

Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6.

CWE-792021

CVE-2021-3879

MEDIUM
CVSS:6.8(Medium)

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-792021