CVE-2020-35200

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 12, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-352015.4Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS.CVE-2020-352025.4Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS.CVE-2020-352036.1Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browsCVE-2020-352046.1Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially craftedCVE-2020-352059.8Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal pCVE-2020-352066.1Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browsCVE-2020-352075.7An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The PIN authenticatioCVE-2020-352085.7An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The password authentiCVE-2020-352097.5An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information.CVE-2020-35216.5A vulnerability in a specific REST API of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker toCVE-2020-352106.5A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessiCVE-2020-352117.5An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node in a target cluster via manipulation of the variable term
CVE-2020-35200: Medium severity, CVSS 6.1 | Vulnix