CVE-2020-9952
HIGHiCloud < 7.21 - Cross-Site Scripting via Malicious Web Content
Title source: llmDescription
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, iCloud for Windows 11.4, iCloud for Windows 7.21. Processing maliciously crafted web content may lead to a cross site scripting attack.
References (12)
Core 12
Core References
Vendor Advisory x_refsource_misc
https://support.apple.com/HT211850
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/HT211844
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/HT211845
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/HT211843
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/HT211846
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/HT211847
Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/Nov/18
Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/Nov/19
Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/Nov/20
Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/Nov/22
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2020/11/23/3
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/202012-10
Scores
CVSS v3
7.1
EPSS
0.0150
EPSS Percentile
71.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Details
CWE
CWE-79
Status
published
Products (7)
apple/icloud
< 7.21
apple/ipados
< 14.0
apple/iphone_os
< 14.0
apple/safari
< 14.0
apple/tvos
< 14.0
apple/watchos
< 7.0
webkit/webkitgtk\+
< 2.30.3
Published
Oct 16, 2020
Tracked Since
Feb 18, 2026