CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1012 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-7980 | Med | 0.40 | 6.1 | 0.01 | Oct 3, 2017 | Cross-site scripting (XSS) vulnerability in the Compass Rose module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "embedding a JavaScript library from an external source that was not reliable." | ||
| CVE-2015-7357 | Med | 0.40 | 6.1 | 0.02 | Oct 3, 2017 | Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #. | ||
| CVE-2017-14957 | Med | 0.40 | 6.1 | 0.01 | Oct 2, 2017 | Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an administrator, an attacker can (for example) change global settings or create/delete posts. It is also possible to… | ||
| CVE-2017-14352 | Med | 0.40 | 6.1 | 0.01 | Sep 30, 2017 | A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. These vulnerabilities could be remotely exploited to allow cross-site scripting. | ||
| CVE-2017-13986 | Med | 0.40 | 6.1 | 0.01 | Sep 30, 2017 | A reflected Cross-Site Scripting(XSS) vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows for unintended information when a specific URL is sent to the system. | ||
| CVE-2017-7554 | Med | 0.40 | 6.1 | 0.01 | Sep 29, 2017 | It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user. An attacker could use this flaw to execute a stored XSS attack on an application administrator using App Studio. | ||
| CVE-2017-11479 | Med | 0.40 | 6.1 | 0.01 | Sep 29, 2017 | Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. | ||
| CVE-2017-10701 | Med | 0.40 | 6.1 | 0.01 | Sep 29, 2017 | Cross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to inject arbitrary web script or HTML, aka SAP Security Notes 2469860, 2471209, and 2488516. | ||
| CVE-2017-1591 | Med | 0.40 | 6.1 | 0.01 | Sep 28, 2017 | IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted… | ||
| CVE-2017-14622 | Med | 0.40 | 6.1 | 0.03 | Sep 28, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php. | ||
| CVE-2015-7349 | Med | 0.40 | 6.1 | 0.01 | Sep 28, 2017 | Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface allows remote attackers to inject arbitrary web script or HTML via the failmessage parameter. | ||
| CVE-2017-14765 | Med | 0.40 | 6.1 | 0.01 | Sep 27, 2017 | In GeniXCMS 1.1.4, gxadmin/index.php has XSS via the Menu ID field in a page=menus request. | ||
| CVE-2017-14762 | Med | 0.40 | 6.1 | 0.01 | Sep 27, 2017 | In GeniXCMS 1.1.4, /inc/lib/Control/Backend/menus.control.php has XSS via the id parameter. | ||
| CVE-2017-14761 | Med | 0.40 | 6.1 | 0.01 | Sep 27, 2017 | In GeniXCMS 1.1.4, /inc/lib/backend/menus.control.php has XSS via the id parameter. | ||
| CVE-2017-14751 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2017 | The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field. | ||
| CVE-2017-14744 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2017 | UEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element. | ||
| CVE-2017-14735 | Med | 0.40 | 6.1 | 0.02 | Sep 25, 2017 | OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL. | ||
| CVE-2015-5169 | Med | 0.40 | 6.1 | 0.08 | Sep 25, 2017 | Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20. | ||
| CVE-2017-9551 | Med | 0.40 | 6.1 | 0.01 | Sep 25, 2017 | Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16.10 before 16.10.5 and 17.04 before 17.04.3 are vulnerable to a user submitting potential dangerous payload, e.g. XSS code, to be saved as their name in the usr_registration table. The values are then emailed to the the… | ||
| CVE-2017-12254 | Med | 0.40 | 6.1 | 0.02 | Sep 21, 2017 | A vulnerability in the web interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to perform a Document Object Model (DOM)-based cross-site scripting attack. The vulnerability is due to insufficient input validation of some parameters… |
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the Compass Rose module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "embedding a JavaScript library from an external source that was not reliable."
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #.
- risk 0.40cvss 6.1epss 0.01
Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an administrator, an attacker can (for example) change global settings or create/delete posts. It is also possible to…
- risk 0.40cvss 6.1epss 0.01
A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. These vulnerabilities could be remotely exploited to allow cross-site scripting.
- risk 0.40cvss 6.1epss 0.01
A reflected Cross-Site Scripting(XSS) vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows for unintended information when a specific URL is sent to the system.
- risk 0.40cvss 6.1epss 0.01
It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user. An attacker could use this flaw to execute a stored XSS attack on an application administrator using App Studio.
- risk 0.40cvss 6.1epss 0.01
Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
- risk 0.40cvss 6.1epss 0.01
Cross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to inject arbitrary web script or HTML, aka SAP Security Notes 2469860, 2471209, and 2488516.
- risk 0.40cvss 6.1epss 0.01
IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
- risk 0.40cvss 6.1epss 0.03
Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface allows remote attackers to inject arbitrary web script or HTML via the failmessage parameter.
- risk 0.40cvss 6.1epss 0.01
In GeniXCMS 1.1.4, gxadmin/index.php has XSS via the Menu ID field in a page=menus request.
- risk 0.40cvss 6.1epss 0.01
In GeniXCMS 1.1.4, /inc/lib/Control/Backend/menus.control.php has XSS via the id parameter.
- risk 0.40cvss 6.1epss 0.01
In GeniXCMS 1.1.4, /inc/lib/backend/menus.control.php has XSS via the id parameter.
- risk 0.40cvss 6.1epss 0.01
The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field.
- risk 0.40cvss 6.1epss 0.01
UEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element.
- risk 0.40cvss 6.1epss 0.02
OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.
- risk 0.40cvss 6.1epss 0.08
Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
- risk 0.40cvss 6.1epss 0.01
Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16.10 before 16.10.5 and 17.04 before 17.04.3 are vulnerable to a user submitting potential dangerous payload, e.g. XSS code, to be saved as their name in the usr_registration table. The values are then emailed to the the…
- risk 0.40cvss 6.1epss 0.02
A vulnerability in the web interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to perform a Document Object Model (DOM)-based cross-site scripting attack. The vulnerability is due to insufficient input validation of some parameters…