CVE-2021-45087

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a a page title.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612Exploit, Vendor Advisory
https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00006.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2022/dsa-5042Third Party Advisory
https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612Exploit, Vendor Advisory
https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00006.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2022/dsa-5042Third Party Advisory

Timeline

Published: Dec 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-450886.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.CVE-2021-450895.2Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control.CVE-2021-450909.8Stormshield Endpoint Security before 2.1.2 allows remote code execution.CVE-2021-450914.3Stormshield Endpoint Security from 2.1.0 to 2.1.1 has Incorrect Access Control.CVE-2021-450929.8Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath paramete CVE-2021-450945.4Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS.CVE-2021-450955.5pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.CVE-2021-450964.3KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730 CVE-2021-450975.5KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without CVE-2021-450987.5An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an RST TCP packet with r CVE-2021-450998.8The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requ CVE-2021-451007.5The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even though encryption has b