CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1017 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-12927 | Med | 0.40 | 6.1 | 0.01 | Aug 18, 2017 | A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php. | ||
| CVE-2017-6788 | Med | 0.40 | 6.1 | 0.01 | Aug 17, 2017 | The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the affected software. The vulnerability is due to… | ||
| CVE-2017-6776 | Med | 0.40 | 6.1 | 0.01 | Aug 17, 2017 | A vulnerability in the web framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface. The vulnerability is due to insufficient validation of… | ||
| CVE-2017-12907 | Med | 0.40 | 6.1 | 0.01 | Aug 17, 2017 | Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the url path to usersearch.php. | ||
| CVE-2017-9802 | Med | 0.40 | 6.1 | 0.04 | Aug 14, 2017 | The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings. | ||
| CVE-2017-12798 | Med | 0.40 | 6.1 | 0.01 | Aug 10, 2017 | Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php. | ||
| CVE-2017-12777 | Med | 0.40 | 6.1 | 0.01 | Aug 9, 2017 | Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via some parameter to usersearch.php. | ||
| CVE-2014-6393 | Med | 0.40 | 6.1 | 0.01 | Aug 9, 2017 | The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding. | ||
| CVE-2017-8642 | Med | 0.40 | 6.1 | 0.03 | Aug 8, 2017 | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to elevate privileges due to the way that Microsoft Edge validates JavaScript under specific conditions, aka "Microsoft Edge Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8503. | ||
| CVE-2017-12677 | Med | 0.40 | 6.1 | 0.01 | Aug 8, 2017 | IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorization response. | ||
| CVE-2017-12655 | Med | 0.40 | 6.1 | 0.01 | Aug 7, 2017 | Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog action. | ||
| CVE-2016-3113 | Med | 0.40 | 6.1 | 0.03 | Aug 7, 2017 | Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2017-12649 | Med | 0.40 | 6.1 | 0.01 | Aug 7, 2017 | XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display. | ||
| CVE-2017-6765 | Med | 0.40 | 6.1 | 0.02 | Aug 7, 2017 | A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.1(6.11) and 9.4(1.2) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an… | ||
| CVE-2017-6762 | Med | 0.40 | 6.1 | 0.01 | Aug 7, 2017 | A vulnerability in the web-based management interface of Cisco Jabber Guest Server 10.6(9), 11.0(0), and 11.0(1) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected… | ||
| CVE-2017-6761 | Med | 0.40 | 6.1 | 0.01 | Aug 7, 2017 | A vulnerability in the web-based management interface of Cisco Finesse 10.6(1) and 11.5(1) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability… | ||
| CVE-2017-12583 | Med | 0.40 | 6.1 | 0.03 | Aug 6, 2017 | DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php. | ||
| CVE-2017-12413 | Med | 0.40 | 6.1 | 0.01 | Aug 4, 2017 | AXIS 2100 devices 2.43 have XSS via the URI, possibly related to admin/admin.shtml. | ||
| CVE-2017-1327 | Med | 0.40 | 6.1 | 0.01 | Aug 3, 2017 | IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126062. | ||
| CVE-2017-9467 | Med | 0.40 | 6.1 | 0.01 | Aug 2, 2017 | Cross-site scripting (XSS) vulnerability in the GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php.
- risk 0.40cvss 6.1epss 0.01
The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the affected software. The vulnerability is due to…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface. The vulnerability is due to insufficient validation of…
- risk 0.40cvss 6.1epss 0.01
Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the url path to usersearch.php.
- risk 0.40cvss 6.1epss 0.04
The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.
- risk 0.40cvss 6.1epss 0.01
Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php.
- risk 0.40cvss 6.1epss 0.01
Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via some parameter to usersearch.php.
- risk 0.40cvss 6.1epss 0.01
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.
- risk 0.40cvss 6.1epss 0.03
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to elevate privileges due to the way that Microsoft Edge validates JavaScript under specific conditions, aka "Microsoft Edge Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8503.
- risk 0.40cvss 6.1epss 0.01
IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorization response.
- risk 0.40cvss 6.1epss 0.01
Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog action.
- risk 0.40cvss 6.1epss 0.03
Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML.
- risk 0.40cvss 6.1epss 0.01
XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display.
- risk 0.40cvss 6.1epss 0.02
A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.1(6.11) and 9.4(1.2) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Jabber Guest Server 10.6(9), 11.0(0), and 11.0(1) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Finesse 10.6(1) and 11.5(1) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability…
- risk 0.40cvss 6.1epss 0.03
DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php.
- risk 0.40cvss 6.1epss 0.01
AXIS 2100 devices 2.43 have XSS via the URI, possibly related to admin/admin.shtml.
- risk 0.40cvss 6.1epss 0.01
IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126062.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.