VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (22,699)

page 1062 of 1,135
  • CVE-2010-2301Jun 15, 2010
    OpenSUSE
    openSUSE
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in editing/markup.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 allows remote attackers to inject arbitrary web script or HTML via vectors related to the node.innerHTML property of a TEXTAREA element. NOTE: this might…

  • CVE-2010-2281Jun 15, 2010
    Tomatocms
    Tomatocms
    risk 0.00cvss —epss 0.00

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS 2.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword or (2) bannerid parameter in conjunction with a /admin/ad/banner/list PATH_INFO; and allow remote authenticated…

  • CVE-2010-2277Jun 15, 2010
    IBM
    Lotus Connections
    risk 0.00cvss —epss 0.00

    Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Connections 2.5.x before 2.5.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) create or (2) edit form in the Communities component, the (3) verbiage field in the Bookmarks component, or…

  • CVE-2010-2273Jun 15, 2010
    Dojotoolkit
    Dojo
    risk 0.00cvss —epss 0.43

    Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to…

  • CVE-2010-2267Jun 15, 2010
    Accoria
    Rock Web Server
    risk 0.00cvss —epss 0.00

    Multiple cross-site scripting (XSS) vulnerabilities in Accoria Web Server (aka Rock Web Server) 1.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the getenv sample program, (2) the desc parameter to loadstatic.cgi, (3) the name…

  • CVE-2010-1515Jun 15, 2010
    Tomatocms
    Tomatocms
    risk 0.00cvss —epss 0.00

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS 2.0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) keyword or (2) article-id parameter in conjunction with a /admin/news/article/list PATH_INFO; the (3) keyword…

  • CVE-2010-2292Jun 15, 2010
    Dlink
    Di 604\+
    risk 0.00cvss —epss 0.00

    Cross-site scripting (XSS) vulnerability in the Ping tools web interface in Dlink Di-604 router allows remote attackers to inject arbitrary web script or HTML via the IP field.

  • CVE-2010-2290Jun 15, 2010
    McAfee
    Unified Threat Management Firewall Firmware
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cgi-bin/cgix/help in McAfee Unified Threat Management (UTM) Firewall (formerly SnapGear) firmware 3.0.0 through 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2010-2288Jun 15, 2010
    Juniper Networks
    Secure Access
    risk 0.00cvss —epss 0.00

    Cross-site scripting (XSS) vulnerability in dana/nc/ncrun.cgi in Juniper Networks IVE 6.5R1 (Build 14599) and 6.5R2 (Build 14951) allows remote attackers to inject arbitrary web script or HTML via the DSSignInURL cookie.

  • CVE-2009-4894Jun 15, 2010
    Punbb
    Punbb
    risk 0.00cvss —epss 0.00

    Multiple cross-site scripting (XSS) vulnerabilities in profile.php in PunBB before 1.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) password or (2) e-mail.

  • CVE-2010-1762Jun 11, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML in a TEXTAREA element.

  • CVE-2010-1418Jun 11, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via a FRAME element with a SRC attribute composed of a…

  • CVE-2010-0544Jun 11, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors related to a malformed URL.

  • CVE-2010-1395Jun 11, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors involving DOM constructor objects, related to a…

  • CVE-2010-1394Jun 11, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML document fragments.

  • CVE-2010-1390Jun 11, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors related to improper UTF-7 canonicalization, and…

  • CVE-2010-1389Jun 11, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a (1) paste or (2)…

  • CVE-2009-4890Jun 11, 2010
    Retrieve
    Vbook
    risk 0.00cvss —epss 0.00

    Multiple cross-site scripting (XSS) vulnerabilities in the login application in vBook 4.2.17 allow remote attackers to inject arbitrary web script or HTML via the (1) title and (2) message parameters.

  • CVE-2009-4885Jun 11, 2010
    Bernhard Frohlich
    Phpcom
    risk 0.00cvss —epss 0.00

    Cross-site scripting (XSS) vulnerability in templates/1/login.php in phpCommunity 2 2.1.8 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2010-2260Jun 9, 2010
    Gambitdesign
    Bandwidth Meter
    risk 0.00cvss —epss 0.00

    Multiple cross-site scripting (XSS) vulnerabilities in Gambit Design Bandwidth Meter, 0.72 and possibly 1.2, allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) view_by_name.php or (2) view_by_ip.php in admin/. NOTE: some sources report that…