CVE-2021-35045

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ endpoint.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 22, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-350466.1A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted sCVE-2021-350478.8Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level acceCVE-2021-350489.8Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerabilitCVE-2021-350498.8Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerabilCVE-2021-35055.5A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug inCVE-2021-350507.5User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains accessCVE-2021-350527.8A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.CVE-2021-350537.5Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change specific Firefox browseCVE-2021-350547.5Minecraft before 1.17.1, when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files.CVE-2021-350558.8MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle the WPS (Wi-Fi Protected Setup) protocol. (ACVE-2021-350566.7Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0 has an unquoted Windows search path for a scheduled task. An unintended executaCVE-2021-350596.1OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter.
CVE-2021-35045: Medium severity, CVSS 6.1 | Vulnix