CVE-2021-35228

This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remo...

CVE-2021-35228

CVE-2021-35228 affects SolarWinds SolarWinds Database Performance Analyzer (DPA) in version 2021.3.7388, due to missing input sanitization of a header-extracted output field, enabling a reflected XSS if an attacker can perform a MITM to modify a header. The vulnerability is described as a reflect...

PT-2021-20851

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is caused by missing input sanitization for an output field extracted from headers on a specific section of a page, leading to a reflective...

CVE-2021-21746

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information...

CVE-2021-21747

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information...

CVE-2021-21746

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information...

Cross site scripting

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information...

CVE-2021-21746

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information...

Cross site scripting

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information...

CVE-2021-21747

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information...

CVE-2021-21747

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information...

CVE-2021-21747

CVE-2021-21747 affects the ZTE MF971R router, with a reflective XSS in the web API. The vulnerability resides in the /api/xmlclient/post endpoint’s cmd parameter, which is not properly sanitized and is reflected in the HTTP response, enabling arbitrary JavaScript execution in the victim’s browser...

CVE-2021-21746

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information...

PT-2021-14758

Name of the Vulnerable Software and Affected Versions ZTE MF971R affected versions not specified Description The ZTE MF971R product is affected by a reflective XSS issue, which could allow an attacker to obtain cookie information. Recommendations At the moment, there is no information about a new...

PT-2021-14757

Name of the Vulnerable Software and Affected Versions ZTE MF971R affected versions not specified Description The issue is related to a reflective XSS vulnerability. An attacker could exploit this to obtain cookie information. Recommendations At the moment, there is no information about a newer...

CVE-2021-21746: Improper Neutralization of Input During Web Page Generation

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information...

CVE-2021-21747: Improper Neutralization of Input During Web Page Generation

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information...

CVE-2021-41565

TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks...

CVE-2021-41565

TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks...

Cross site scripting

TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks...