CVE-2015-10072lowCWE-79

CVE-2015-10072: low-severity vulnerability in NREL api-umbrella-web

NREL api-umbrella-web Flash Message cross site scripting

Published · Updated

Follow this CVE+ Monitor api-umbrella-web

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.5epss 0.5%
A vulnerability classified as problematic was found in NREL api-umbrella-web 0.7.1. This vulnerability affects unknown code of the component Flash Message Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.0 is able to address this issue. The name of the patch is bcc0e922c61d30367678c8f17a435950969315cd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-220060.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected products
NREL · api-umbrella-web
Related CVEs — NREL api-umbrella-web

In the same product, most dangerous first.

CVE-2015-10080LOWNREL api-umbrella-web Admin Data Table cross site scriptingEPSS 0.5%