CVE-2021-46677

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the event filter name field.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-466786.1A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the servic CVE-2021-466796.1A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via service el CVE-2021-466806.1A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the module CVE-2021-466816.1A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via module mas CVE-2021-466869.8Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlie CVE-2021-466874.9JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. CVE-2021-466997.8A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains a stack based buffer overfl CVE-2021-467006.5In libsixel 1.8.6, sixel_encoder_output_without_macro (called from sixel_encoder_encode_frame in encoder.c) has a double free.CVE-2021-467016.5PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket,CVE-2021-467025.5Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended CVE-2021-467039.8In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandbox CVE-2021-467049.8In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/u