CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1031 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-5075 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2017 | CloudView NMS before 2.10a has XSS via a TELNET login. | ||
| CVE-2016-5073 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2017 | CloudView NMS before 2.10a has XSS via SNMP. | ||
| CVE-2016-5055 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2017 | OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page. | ||
| CVE-2015-7275 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2017 | Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS. | ||
| CVE-2015-6035 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2017 | Opsview before 2015-11-06 has XSS via SNMP. | ||
| CVE-2015-6027 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2017 | Castle Rock Computing SNMPc before 2015-12-17 has XSS via SNMP. | ||
| CVE-2015-6021 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2017 | Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response. | ||
| CVE-2017-7591 | Med | 0.40 | 6.1 | 0.01 | Apr 9, 2017 | OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by the _sortKeys parameter to the authzRoles script under managed/user/. | ||
| CVE-2017-7590 | Med | 0.40 | 6.1 | 0.01 | Apr 9, 2017 | OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by a crafted Managed Object Name. | ||
| CVE-2017-7583 | Med | 0.40 | 6.1 | 0.01 | Apr 7, 2017 | ILIAS before 5.2.3 has XSS via SVG documents. | ||
| CVE-2017-3848 | Med | 0.40 | 6.1 | 0.01 | Apr 7, 2017 | A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected system. More Information: CSCuw63001… | ||
| CVE-2017-7579 | Med | 0.40 | 6.1 | 0.01 | Apr 7, 2017 | inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field. | ||
| CVE-2016-1000307 | Med | 0.40 | 6.1 | 0.01 | Apr 6, 2017 | Multiple Cross Site Scripting (XSS) Vulnerabilities in ClipBucket v2.8.1 and probably prior allow Remote Attackers to inject arbitrary web script or HTML via (1) profile_desc, about_me, schools, occupation, companies, hobbies, fav_movies, fav_music, fav_books parameters to… | ||
| CVE-2016-8789 | Med | 0.40 | 6.1 | 0.01 | Apr 2, 2017 | Huawei eSpace Integrated Access Device (IAD) with software V300R001C03, V300R001C04, V300R001C06, V300R001C20, and V300R001C07 allows an attacker to trick a user into clicking a URL containing malicious scripts to obtain user information or hijack the session, aka XSS. | ||
| CVE-2017-2475 | Med | 0.40 | 6.1 | 0.02 | Apr 2, 2017 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted use of frames… | ||
| CVE-2017-2393 | Med | 0.40 | 6.1 | 0.01 | Apr 2, 2017 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Safari Reader" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site. | ||
| CVE-2017-7389 | Med | 0.40 | 6.1 | 0.01 | Apr 1, 2017 | Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'. The vulnerabilities exist due to insufficient filtration of user-supplied data (meeting_id, user) passed to the 'openeclass-master/modules/tc/webconf/webconf.php' URL. An attacker could execute… | ||
| CVE-2017-7388 | Med | 0.40 | 6.1 | 0.01 | Apr 1, 2017 | A Cross-Site Scripting (XSS) was discovered in 'wallacepos v1.4.1'. The vulnerability exists due to insufficient filtration of user-supplied data (token) passed to the 'wallacepos-master/myaccount/resetpassword.php' URL. An attacker could execute arbitrary HTML and script code… | ||
| CVE-2017-7387 | Med | 0.40 | 6.1 | 0.01 | Apr 1, 2017 | TheFirstQuestion/HelpMeWatchWho before 2017-03-28 is vulnerable to a reflected XSS in HelpMeWatchWho-master/unaired.php (episodeID parameter). | ||
| CVE-2017-7386 | Med | 0.40 | 6.1 | 0.01 | Apr 1, 2017 | citymont/symetrie v.0.9.6 is vulnerable to a reflected XSS in symetrie-master/app/commands/page.php (model parameter). |
- risk 0.40cvss 6.1epss 0.01
CloudView NMS before 2.10a has XSS via a TELNET login.
- risk 0.40cvss 6.1epss 0.01
CloudView NMS before 2.10a has XSS via SNMP.
- risk 0.40cvss 6.1epss 0.01
OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page.
- risk 0.40cvss 6.1epss 0.01
Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS.
- risk 0.40cvss 6.1epss 0.01
Opsview before 2015-11-06 has XSS via SNMP.
- risk 0.40cvss 6.1epss 0.01
Castle Rock Computing SNMPc before 2015-12-17 has XSS via SNMP.
- risk 0.40cvss 6.1epss 0.01
Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response.
- risk 0.40cvss 6.1epss 0.01
OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by the _sortKeys parameter to the authzRoles script under managed/user/.
- risk 0.40cvss 6.1epss 0.01
OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by a crafted Managed Object Name.
- risk 0.40cvss 6.1epss 0.01
ILIAS before 5.2.3 has XSS via SVG documents.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected system. More Information: CSCuw63001…
- risk 0.40cvss 6.1epss 0.01
inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field.
- risk 0.40cvss 6.1epss 0.01
Multiple Cross Site Scripting (XSS) Vulnerabilities in ClipBucket v2.8.1 and probably prior allow Remote Attackers to inject arbitrary web script or HTML via (1) profile_desc, about_me, schools, occupation, companies, hobbies, fav_movies, fav_music, fav_books parameters to…
- risk 0.40cvss 6.1epss 0.01
Huawei eSpace Integrated Access Device (IAD) with software V300R001C03, V300R001C04, V300R001C06, V300R001C20, and V300R001C07 allows an attacker to trick a user into clicking a URL containing malicious scripts to obtain user information or hijack the session, aka XSS.
- risk 0.40cvss 6.1epss 0.02
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted use of frames…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Safari Reader" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site.
- risk 0.40cvss 6.1epss 0.01
Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'. The vulnerabilities exist due to insufficient filtration of user-supplied data (meeting_id, user) passed to the 'openeclass-master/modules/tc/webconf/webconf.php' URL. An attacker could execute…
- risk 0.40cvss 6.1epss 0.01
A Cross-Site Scripting (XSS) was discovered in 'wallacepos v1.4.1'. The vulnerability exists due to insufficient filtration of user-supplied data (token) passed to the 'wallacepos-master/myaccount/resetpassword.php' URL. An attacker could execute arbitrary HTML and script code…
- risk 0.40cvss 6.1epss 0.01
TheFirstQuestion/HelpMeWatchWho before 2017-03-28 is vulnerable to a reflected XSS in HelpMeWatchWho-master/unaired.php (episodeID parameter).
- risk 0.40cvss 6.1epss 0.01
citymont/symetrie v.0.9.6 is vulnerable to a reflected XSS in symetrie-master/app/commands/page.php (model parameter).