VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,564)

page 1016 of 2,429
  • CVE-2015-1177MedAug 28, 2017
    Exponent
    Exponentcms
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2.

  • CVE-2015-0101MedAug 28, 2017
    IBM
    Business Process Manager
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Business Process Manager Standard 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; IBM Business Process Manager Express 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; and IBM Business Process Manager Advanced…

  • CVE-2014-9557MedAug 28, 2017
    Smartcms
    Smartcms
    risk 0.40cvss 6.1epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in SmartCMS v.2.

  • CVE-2014-9514MedAug 28, 2017
    BMC Software
    Footprints Service Core
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in BMC Footprints Service Core 11.5.

  • CVE-2014-9469MedAug 28, 2017
    Jelsoft
    Vbulletin
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3.

  • CVE-2014-8753MedAug 28, 2017
    Cit E Net
    Cit E Access
    risk 0.40cvss 6.1epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Cit-e-Net Cit-e-Access 6.

  • CVE-2014-4925MedAug 28, 2017
    Good
    Good For Enterprise
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Good for Enterprise for Android 2.8.0.398 and 1.9.0.40.

  • CVE-2014-0141MedAug 28, 2017
    Red Hat
    Satellite
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Red Hat Satellite 6.0.3.

  • CVE-2015-3257MedAug 25, 2017
    Zend
    Diactoros
    risk 0.40cvss 6.1epss 0.01

    Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting (XSS) or open redirect attacks.

  • CVE-2017-13697MedAug 25, 2017
    Finecms Project
    Finecms
    risk 0.40cvss 6.1epss 0.01

    controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable.

  • CVE-2015-4699MedAug 24, 2017
    Cloud4wi
    Splash Portal
    risk 0.40cvss 6.1epss 0.02

    Cross-site scripting (XSS) vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI.

  • CVE-2017-13671MedAug 24, 2017
    Misp
    Misp
    risk 0.40cvss 6.1epss 0.01

    app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of the same instance because the comment field is not part of the MISP synchronisation.

  • CVE-2017-13138MedAug 23, 2017
    WordPress
    Bridge
    risk 0.40cvss 6.1epss 0.01

    DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript.

  • CVE-2014-6189MedAug 22, 2017
    IBM
    Security Network Protection 7100 Firmware
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Security Network Protection 3100, 4100, 5100, and 7100 devices with firmware 5.2 before 5.2.0.0-ISS-XGS-All-Models-Hotfix-FP0008 and 5.3 before 5.3.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified…

  • CVE-2017-7421MedAug 21, 2017
    Microfocus
    Directory Server
    risk 0.40cvss 6.1epss 0.01

    Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1…

  • CVE-2017-12980MedAug 21, 2017
    Dokuwiki
    Dokuwiki
    risk 0.40cvss 6.1epss 0.01

    DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create or edit a wiki that uses RSS or Atom data from an attacker-controlled server to trigger JavaScript execution. The JavaScript can be in an…

  • CVE-2017-12979MedAug 21, 2017
    Dokuwiki
    Dokuwiki
    risk 0.40cvss 6.1epss 0.01

    DokuWiki through 2017-02-19c has stored XSS when rendering a malicious language name in a code element, in /inc/parser/xhtml.php. An attacker can create or edit a wiki with this element to trigger JavaScript execution.

  • CVE-2017-12948MedAug 18, 2017
    Pressforward
    Pressforward
    risk 0.40cvss 6.1epss 0.01

    Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, related to PHP_SELF.

  • CVE-2017-9816MedAug 18, 2017
    Paessler
    Prtg Network Monitor
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Paessler PRTG Network Monitor before 17.2.32.2279 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2017-12680MedAug 18, 2017
    Nexusphp Project
    Nexusphp
    risk 0.40cvss 6.1epss 0.01

    Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php.