VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,564)

page 1472 of 2,429
  • CVE-2020-17006MedNov 11, 2020
    Microsoft
    Dynamics 365
    risk 0.35cvss 5.4epss 0.01

    Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

  • CVE-2020-17005MedNov 11, 2020
    Microsoft
    Dynamics 365
    risk 0.35cvss 5.4epss 0.01

    Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

  • CVE-2020-25267MedNov 10, 2020
    Ilias
    Ilias
    risk 0.35cvss 5.4epss 0.01

    An XSS issue exists in the question-pool file-upload preview feature in ILIAS 6.4.

  • CVE-2020-28409MedNov 10, 2020
    Dundas
    Dundas Bi
    risk 0.35cvss 5.4epss 0.01

    The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g., a button) when events such as click, hover, etc. occur.

  • CVE-2020-28408MedNov 10, 2020
    Dundas
    Dundas Bi
    risk 0.35cvss 5.4epss 0.01

    The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard.

  • CVE-2020-4760MedNov 10, 2020
    IBM
    Content Navigator
    risk 0.35cvss 5.4epss 0.01

    IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…

  • CVE-2020-4704MedNov 10, 2020
    IBM
    Content Navigator
    risk 0.35cvss 5.4epss 0.01

    IBM Content Navigator 3.0CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…

  • CVE-2020-9299MedNov 9, 2020
    Netflix
    Dispatch
    risk 0.35cvss 5.4epss 0.01

    There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be exploited by an authenticated user.

  • CVE-2020-5940MedNov 5, 2020
    risk 0.35cvss 5.4epss 0.01

    In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.

  • CVE-2020-28047MedNov 5, 2020
    Web Audimex
    Audimexee
    risk 0.35cvss 5.4epss 0.01

    AudimexEE before 14.1.1 is vulnerable to Reflected XSS (Cross-Site-Scripting). If the recommended security configuration parameter "unique_error_numbers" is not set, remote attackers can inject arbitrary web script or HTML via 'action, cargo, panel' parameters that can lead to…

  • CVE-2019-7356MedNov 4, 2020
    Subrion
    CMS
    risk 0.35cvss 5.4epss 0.01

    Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter.

  • CVE-2020-2317MedNov 4, 2020
    Jenkins Project
    Findbugs
    risk 0.35cvss 5.4epss 0.01

    Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to Jenkins FindBugs Plugin's post build step.

  • CVE-2020-2316MedNov 4, 2020
    Jenkins Project
    Static Analysis Utilities
    risk 0.35cvss 5.4epss 0.01

    Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

  • CVE-2020-23989MedNov 2, 2020
    Nedi
    Nedi
    risk 0.35cvss 5.4epss 0.01

    NeDi 1.9C allows pwsec.php oid XSS.

  • CVE-2020-23868MedNov 2, 2020
    Nedi
    Nedi
    risk 0.35cvss 5.4epss 0.01

    NeDi 1.9C allows inc/rt-popup.php d XSS.

  • CVE-2020-27359MedNov 2, 2020
    Evms
    Redcap
    risk 0.35cvss 5.4epss 0.01

    A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user…

  • CVE-2020-15914MedNov 2, 2020
    Ea
    Origin Client
    risk 0.35cvss 5.4epss 0.01

    A cross-site scripting (XSS) vulnerability exists in the Origin Client for Mac and PC 10.5.86 or earlier that could allow a remote attacker to execute arbitrary Javascript in a target user’s Origin client. An attacker could use this vulnerability to access sensitive data…

  • CVE-2020-25516MedOct 29, 2020
    risk 0.35cvss 5.4epss 0.01

    WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks.

  • CVE-2020-24712MedOct 28, 2020
    Gophish
    Gophish
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.

  • CVE-2020-24709MedOct 28, 2020
    Gophish
    Gophish
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.