CVE-2020-28947

MediumCVSS 6.1/10Last modified Jun 22, 2026

Description

In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 19, 2020
Last modified
Jun 22, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-289487.8Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.CVE-2020-289497.8Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as filCVE-2020-28954.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.19 and prior. EaCVE-2020-289507.8The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an atCVE-2020-289519.8libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names. This is related CVE-2020-289527.5An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. ZigBee hub devices should generate a unique Standard Network Key CVE-2020-289534.3In BigBlueButton before 2.2.29, a user can vote more than once in a single poll.CVE-2020-289545.3web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting contrCVE-2020-289555.4SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability alloCVE-2020-289565.4Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scriptCVE-2020-289575.4Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web CVE-2020-28964.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are
CVE-2020-28947: Medium severity, CVSS 6.1 | Vulnix