CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1046 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-6451 | Med | 0.40 | 6.1 | 0.01 | Nov 3, 2016 | Multiple vulnerabilities in the web framework code of the Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information:… | ||
| CVE-2016-6429 | Med | 0.40 | 6.1 | 0.01 | Nov 3, 2016 | A vulnerability in the web framework code of the Cisco IP Interoperability and Collaboration System (IPICS) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. More Information: CSCva47092. Known Affected Releases: 4.10(1). | ||
| CVE-2016-8583 | Med | 0.40 | 6.1 | 0.01 | Oct 28, 2016 | Multiple GET parameters in the vulnerability scan scheduler of AlienVault OSSIM and USM before 5.3.2 are vulnerable to reflected XSS. | ||
| CVE-2016-1423 | Med | 0.40 | 6.1 | 0.02 | Oct 28, 2016 | A vulnerability in the display of email messages in the Messages in Quarantine (MIQ) view in Cisco AsyncOS for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a user to click a malicious link in the MIQ view. The malicious link could… | ||
| CVE-2016-1592 | Med | 0.40 | 6.1 | 0.01 | Oct 27, 2016 | XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the nrfEntitlementReport.do CGI. | ||
| CVE-2015-0787 | Med | 0.40 | 6.1 | 0.01 | Oct 27, 2016 | XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the accessMgrDN value of the forgotUser.do CGI. | ||
| CVE-2016-8506 | Med | 0.40 | 6.1 | 0.01 | Oct 26, 2016 | XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code. | ||
| CVE-2016-8505 | Med | 0.40 | 6.1 | 0.01 | Oct 26, 2016 | XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code. | ||
| CVE-2016-5512 | Med | 0.40 | 6.1 | 0.01 | Oct 25, 2016 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-5521. | ||
| CVE-2016-0246 | Med | 0.40 | 6.1 | 0.01 | Oct 22, 2016 | Cross-site scripting (XSS) vulnerability in IBM Security Guardium 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. | ||
| CVE-2016-1000155 | Med | 0.40 | 6.1 | 0.04 | Oct 10, 2016 | Reflected XSS in wordpress plugin wpsolr-search-engine v7.6 | ||
| CVE-2016-1000154 | Med | 0.40 | 6.1 | 0.03 | Oct 10, 2016 | Reflected XSS in wordpress plugin whizz v1.0.7 | ||
| CVE-2016-1000153 | Med | 0.40 | 6.1 | 0.04 | Oct 10, 2016 | Reflected XSS in wordpress plugin tidio-gallery v1.1 | ||
| CVE-2016-1000152 | Med | 0.40 | 6.1 | 0.04 | Oct 10, 2016 | Reflected XSS in wordpress plugin tidio-form v1.0 | ||
| CVE-2016-1000151 | Med | 0.40 | 6.1 | 0.02 | Oct 10, 2016 | Reflected XSS in wordpress plugin tera-charts v1.0 | ||
| CVE-2016-1000150 | Med | 0.40 | 6.1 | 0.02 | Oct 10, 2016 | Reflected XSS in wordpress plugin simplified-content v1.0.0 | ||
| CVE-2016-1000149 | Med | 0.40 | 6.1 | 0.04 | Oct 10, 2016 | Reflected XSS in wordpress plugin simpel-reserveren v3.5.2 | ||
| CVE-2016-1000148 | Med | 0.40 | 6.1 | 0.03 | Oct 10, 2016 | Reflected XSS in wordpress plugin s3-video v0.983 | ||
| CVE-2016-1000147 | Med | 0.40 | 6.1 | 0.02 | Oct 10, 2016 | Reflected XSS in wordpress plugin recipes-writer v1.0.4 | ||
| CVE-2016-1000146 | Med | 0.40 | 6.1 | 0.03 | Oct 10, 2016 | Reflected XSS in wordpress plugin pondol-formmail v1.1 |
- risk 0.40cvss 6.1epss 0.01
Multiple vulnerabilities in the web framework code of the Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information:…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web framework code of the Cisco IP Interoperability and Collaboration System (IPICS) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. More Information: CSCva47092. Known Affected Releases: 4.10(1).
- risk 0.40cvss 6.1epss 0.01
Multiple GET parameters in the vulnerability scan scheduler of AlienVault OSSIM and USM before 5.3.2 are vulnerable to reflected XSS.
- risk 0.40cvss 6.1epss 0.02
A vulnerability in the display of email messages in the Messages in Quarantine (MIQ) view in Cisco AsyncOS for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a user to click a malicious link in the MIQ view. The malicious link could…
- risk 0.40cvss 6.1epss 0.01
XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the nrfEntitlementReport.do CGI.
- risk 0.40cvss 6.1epss 0.01
XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the accessMgrDN value of the forgotUser.do CGI.
- risk 0.40cvss 6.1epss 0.01
XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code.
- risk 0.40cvss 6.1epss 0.01
XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code.
- risk 0.40cvss 6.1epss 0.01
Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-5521.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in IBM Security Guardium 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
- risk 0.40cvss 6.1epss 0.04
Reflected XSS in wordpress plugin wpsolr-search-engine v7.6
- risk 0.40cvss 6.1epss 0.03
Reflected XSS in wordpress plugin whizz v1.0.7
- risk 0.40cvss 6.1epss 0.04
Reflected XSS in wordpress plugin tidio-gallery v1.1
- risk 0.40cvss 6.1epss 0.04
Reflected XSS in wordpress plugin tidio-form v1.0
- risk 0.40cvss 6.1epss 0.02
Reflected XSS in wordpress plugin tera-charts v1.0
- risk 0.40cvss 6.1epss 0.02
Reflected XSS in wordpress plugin simplified-content v1.0.0
- risk 0.40cvss 6.1epss 0.04
Reflected XSS in wordpress plugin simpel-reserveren v3.5.2
- risk 0.40cvss 6.1epss 0.03
Reflected XSS in wordpress plugin s3-video v0.983
- risk 0.40cvss 6.1epss 0.02
Reflected XSS in wordpress plugin recipes-writer v1.0.4
- risk 0.40cvss 6.1epss 0.03
Reflected XSS in wordpress plugin pondol-formmail v1.1