CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1015 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-14036 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2017 | CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS. | ||
| CVE-2016-6800 | Med | 0.40 | 6.1 | 0.04 | Aug 30, 2017 | The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the… | ||
| CVE-2017-13778 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2017 | Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter. | ||
| CVE-2017-13762 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2017 | ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS. | ||
| CVE-2017-1427 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2017 | IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:… | ||
| CVE-2017-3155 | Med | 0.40 | 6.1 | 0.02 | Aug 29, 2017 | Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting. | ||
| CVE-2017-3153 | Med | 0.40 | 6.1 | 0.02 | Aug 29, 2017 | Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality. | ||
| CVE-2017-3152 | Med | 0.40 | 6.1 | 0.02 | Aug 29, 2017 | Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality. | ||
| CVE-2017-3151 | Med | 0.40 | 6.1 | 0.02 | Aug 29, 2017 | Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality. | ||
| CVE-2017-3150 | Med | 0.40 | 6.1 | 0.02 | Aug 29, 2017 | Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script. | ||
| CVE-2013-7433 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2017 | Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla!. | ||
| CVE-2017-12856 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2017 | Cross-site scripting (XSS) vulnerability in C.P.Sub 5.2 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter to index.php. | ||
| CVE-2015-6942 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2017 | Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment. | ||
| CVE-2015-6588 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2017 | Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING. | ||
| CVE-2017-2257 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2017 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via mail function. | ||
| CVE-2017-10840 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2017 | Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2017-10838 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2017 | Cross-site scripting vulnerability in SEO Panel prior to version 3.11.0 allows an attacker to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2017-10837 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2017 | Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2013-7430 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2017 | Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the xmlns parameter. | ||
| CVE-2015-2046 | Med | 0.40 | 6.1 | 0.02 | Aug 28, 2017 | Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20. |
- risk 0.40cvss 6.1epss 0.01
CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS.
- risk 0.40cvss 6.1epss 0.04
The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the…
- risk 0.40cvss 6.1epss 0.01
Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter.
- risk 0.40cvss 6.1epss 0.01
ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS.
- risk 0.40cvss 6.1epss 0.01
IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
- risk 0.40cvss 6.1epss 0.02
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting.
- risk 0.40cvss 6.1epss 0.02
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.
- risk 0.40cvss 6.1epss 0.02
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality.
- risk 0.40cvss 6.1epss 0.02
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality.
- risk 0.40cvss 6.1epss 0.02
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla!.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in C.P.Sub 5.2 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter to index.php.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via mail function.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in SEO Panel prior to version 3.11.0 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the xmlns parameter.
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20.