CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1157 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-13288 | Med | 0.36 | 5.5 | 0.04 | Aug 12, 2020 | In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page | ||
| CVE-2020-16157 | Med | 0.36 | 5.4 | 0.14 | Jul 30, 2020 | A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu. | ||
| CVE-2020-1055 | Med | 0.36 | 5.5 | 0.02 | May 21, 2020 | A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize user inputs. An un-authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected ADFS server. The attacker… | ||
| CVE-2020-7656 | Med | 0.36 | 6.1 | 0.06 | May 19, 2020 | jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "", which results in the enclosed script logic to be executed. | ||
| CVE-2018-21167 | Med | 0.36 | 5.5 | 0.01 | Apr 27, 2020 | Certain NETGEAR devices are affected by stored XSS. This affects D6100 before 1.0.0.57, DM200 before 1.0.0.50, EX2700 before 1.0.1.32, EX6100v2 before 1.0.1.70, EX6150v2 before 1.0.1.70, EX6200v2 before 1.0.1.62, EX6400 before 1.0.1.78, EX7300 before 1.0.1.78, EX8000 before… | ||
| CVE-2013-1938 | Med | 0.36 | 6.1 | 0.03 | Feb 12, 2020 | Zimbra 2013 has XSS in aspell.php | ||
| CVE-2012-1915 | Med | 0.36 | 6.1 | 0.02 | Jan 9, 2020 | EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks. | ||
| CVE-2019-19742 | Med | 0.36 | 4.8 | 0.20 | Dec 18, 2019 | On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field. | ||
| CVE-2019-13182 | Med | 0.36 | 5.4 | 0.06 | Dec 16, 2019 | A stored cross-site scripting (XSS) vulnerability exists in the web UI of SolarWinds Serv-U FTP Server 15.1.7. | ||
| CVE-2011-4090 | Med | 0.36 | 6.1 | 0.03 | Nov 26, 2019 | Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation. | ||
| CVE-2012-1001 | Med | 0.36 | 6.1 | 0.04 | Nov 21, 2019 | Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php. | ||
| CVE-2019-17220 | Med | 0.36 | 6.1 | 0.04 | Oct 21, 2019 | Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line. | ||
| CVE-2019-16197 | Med | 0.36 | 6.1 | 0.03 | Sep 16, 2019 | In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS. | ||
| CVE-2019-13476 | Med | 0.36 | 5.4 | 0.07 | Aug 21, 2019 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page. | ||
| CVE-2019-11828 | Med | 0.36 | 5.5 | 0.01 | Jun 30, 2019 | Cross-site scripting (XSS) vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-13380 | Med | 0.36 | 4.7 | 0.62 | Jun 4, 2019 | A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or… | ||
| CVE-2019-12190 | Med | 0.36 | 5.4 | 0.05 | May 21, 2019 | XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter. | ||
| CVE-2019-0213 | Med | 0.36 | 6.5 | 0.05 | Apr 30, 2019 | In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the… | ||
| CVE-2019-6979 | Med | 0.36 | 6.1 | 0.02 | Jan 28, 2019 | An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB. There is XSS via the admin/modules/tools/ip_history_logs.php useragent field. | ||
| CVE-2019-6804 | Med | 0.36 | 6.1 | 0.05 | Jan 25, 2019 | An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/_wfitemEdit.gsp. |
- risk 0.36cvss 5.5epss 0.04
In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page
- risk 0.36cvss 5.4epss 0.14
A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu.
- risk 0.36cvss 5.5epss 0.02
A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize user inputs. An un-authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected ADFS server. The attacker…
- risk 0.36cvss 6.1epss 0.06
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "", which results in the enclosed script logic to be executed.
- risk 0.36cvss 5.5epss 0.01
Certain NETGEAR devices are affected by stored XSS. This affects D6100 before 1.0.0.57, DM200 before 1.0.0.50, EX2700 before 1.0.1.32, EX6100v2 before 1.0.1.70, EX6150v2 before 1.0.1.70, EX6200v2 before 1.0.1.62, EX6400 before 1.0.1.78, EX7300 before 1.0.1.78, EX8000 before…
- risk 0.36cvss 6.1epss 0.03
Zimbra 2013 has XSS in aspell.php
- risk 0.36cvss 6.1epss 0.02
EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks.
- risk 0.36cvss 4.8epss 0.20
On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.
- risk 0.36cvss 5.4epss 0.06
A stored cross-site scripting (XSS) vulnerability exists in the web UI of SolarWinds Serv-U FTP Server 15.1.7.
- risk 0.36cvss 6.1epss 0.03
Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.
- risk 0.36cvss 6.1epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php.
- risk 0.36cvss 6.1epss 0.04
Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.
- risk 0.36cvss 6.1epss 0.03
In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS.
- risk 0.36cvss 5.4epss 0.07
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page.
- risk 0.36cvss 5.5epss 0.01
Cross-site scripting (XSS) vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.36cvss 4.7epss 0.62
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or…
- risk 0.36cvss 5.4epss 0.05
XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter.
- risk 0.36cvss 6.5epss 0.05
In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the…
- risk 0.36cvss 6.1epss 0.02
An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB. There is XSS via the admin/modules/tools/ip_history_logs.php useragent field.
- risk 0.36cvss 6.1epss 0.05
An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/_wfitemEdit.gsp.