CVE-2020-15788

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Polarion Subversion Webclient (All versions). The Polarion subversion web application does not filter user input in a way that prevents Cross-Site Scripting. If a user is enticed into passing specially crafted, malicious input to the web client (e.g. by clicking on a malicious URL with embedded JavaScript), then JavaScript code can be returned and may then be executed by the user’s client. Various actions could be triggered by running malicious JavaScript code.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-157898.1A vulnerability has been identified in Polarion Subversion Webclient (All versions). The web interface could allow a Cross-Site Request ForgCVE-2020-15797.8An elevation of privilege vulnerability exists when the Windows Function Discovery SSDP Provider improperly handles memory. To exploit this CVE-2020-157905.3A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). If configured in an insecure manner, the web server mighCVE-2020-157916.5A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-4CVE-2020-157924.3A vulnerability has been identified in Desigo Insight (All versions). The web service does not properly apply input validation for some querCVE-2020-157935.4A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header whichCVE-2020-157944.3A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to tCVE-2020-157958.1A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions <CVE-2020-157967.5A vulnerability has been identified in SIMATIC ET 200SP Open Controller (incl. SIPLUS variants) (V20.8), SIMATIC S7-1500 Software ControllerCVE-2020-157976.8A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers CVE-2020-157989.8A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP MoCVE-2020-157996.5A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT s
CVE-2020-15788: Medium severity, CVSS 6.1 | Vulnix