CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1020 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-7059 | Med | 0.40 | 6.1 | 0.01 | Jul 20, 2017 | A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. | ||
| CVE-2017-7038 | Med | 0.40 | 6.1 | 0.03 | Jul 20, 2017 | A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. | ||
| CVE-2017-10676 | Med | 0.40 | 6.1 | 0.01 | Jul 20, 2017 | On D-Link DIR-600M devices before C1_v3.05ENB01_beta_20170306, XSS was found in the form2userconfig.cgi username parameter. | ||
| CVE-2017-1203 | Med | 0.40 | 6.1 | 0.01 | Jul 19, 2017 | IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials… | ||
| CVE-2017-9764 | Med | 0.40 | 6.1 | 0.01 | Jul 19, 2017 | Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action. | ||
| CVE-2017-10801 | Med | 0.40 | 6.1 | 0.01 | Jul 19, 2017 | phpSocial (formerly phpDolphin) before 3.0.1 has XSS in the PATH_INFO to the search/tag/ URI. | ||
| CVE-2017-10962 | Med | 0.40 | 6.1 | 0.01 | Jul 18, 2017 | REDCap before 7.5.1 has XSS via the query string. | ||
| CVE-2017-9934 | Med | 0.40 | 6.1 | 0.02 | Jul 17, 2017 | Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability. | ||
| CVE-2017-8896 | Med | 0.40 | 6.1 | 0.01 | Jul 17, 2017 | ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters. | ||
| CVE-2017-7663 | Med | 0.40 | 6.1 | 0.03 | Jul 17, 2017 | Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0. | ||
| CVE-2017-3103 | Med | 0.40 | 6.1 | 0.03 | Jul 17, 2017 | Adobe Connect versions 9.6.1 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to a stored cross-site scripting attack. | ||
| CVE-2017-3102 | Med | 0.40 | 6.1 | 0.03 | Jul 17, 2017 | Adobe Connect versions 9.6.1 and earlier have a reflected cross-site scripting vulnerability. Successful exploitation could lead to a reflected cross-site scripting attack. | ||
| CVE-2017-1000078 | Med | 0.40 | 6.1 | 0.01 | Jul 17, 2017 | Linux foundation ONOS 1.9 is vulnerable to XSS in the device. registration | ||
| CVE-2017-1000065 | Med | 0.40 | 6.1 | 0.01 | Jul 17, 2017 | Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users) functionality allows attackers to inject arbitrary web scripts and execute malicious scripts within an authenticated client's browser. | ||
| CVE-2017-1000063 | Med | 0.40 | 6.1 | 0.01 | Jul 17, 2017 | kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosure | ||
| CVE-2017-1000059 | Med | 0.40 | 6.1 | 0.01 | Jul 17, 2017 | Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users. | ||
| CVE-2017-1000058 | Med | 0.40 | 6.1 | 0.01 | Jul 17, 2017 | Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser. | ||
| CVE-2017-1000054 | Med | 0.40 | 6.1 | 0.01 | Jul 17, 2017 | Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages. | ||
| CVE-2017-1000051 | Med | 0.40 | 6.1 | 0.01 | Jul 17, 2017 | Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the pad content | ||
| CVE-2017-1000043 | Med | 0.40 | 6.1 | 0.01 | Jul 17, 2017 | Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control |
- risk 0.40cvss 6.1epss 0.01
A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.
- risk 0.40cvss 6.1epss 0.03
A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.
- risk 0.40cvss 6.1epss 0.01
On D-Link DIR-600M devices before C1_v3.05ENB01_beta_20170306, XSS was found in the form2userconfig.cgi username parameter.
- risk 0.40cvss 6.1epss 0.01
IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action.
- risk 0.40cvss 6.1epss 0.01
phpSocial (formerly phpDolphin) before 3.0.1 has XSS in the PATH_INFO to the search/tag/ URI.
- risk 0.40cvss 6.1epss 0.01
REDCap before 7.5.1 has XSS via the query string.
- risk 0.40cvss 6.1epss 0.02
Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability.
- risk 0.40cvss 6.1epss 0.01
ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters.
- risk 0.40cvss 6.1epss 0.03
Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0.
- risk 0.40cvss 6.1epss 0.03
Adobe Connect versions 9.6.1 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to a stored cross-site scripting attack.
- risk 0.40cvss 6.1epss 0.03
Adobe Connect versions 9.6.1 and earlier have a reflected cross-site scripting vulnerability. Successful exploitation could lead to a reflected cross-site scripting attack.
- risk 0.40cvss 6.1epss 0.01
Linux foundation ONOS 1.9 is vulnerable to XSS in the device. registration
- risk 0.40cvss 6.1epss 0.01
Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users) functionality allows attackers to inject arbitrary web scripts and execute malicious scripts within an authenticated client's browser.
- risk 0.40cvss 6.1epss 0.01
kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosure
- risk 0.40cvss 6.1epss 0.01
Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users.
- risk 0.40cvss 6.1epss 0.01
Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser.
- risk 0.40cvss 6.1epss 0.01
Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the pad content
- risk 0.40cvss 6.1epss 0.01
Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control