CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1486 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-5889 | Med | 0.35 | 5.4 | 0.01 | Apr 30, 2020 | On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client. | ||
| CVE-2020-12472 | Med | 0.35 | 5.4 | 0.01 | Apr 29, 2020 | MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description. | ||
| CVE-2019-7634 | Med | 0.35 | 5.4 | 0.01 | Apr 29, 2020 | SUAP V2 allows XSS during the update of user information. | ||
| CVE-2020-12438 | Med | 0.35 | 5.4 | 0.01 | Apr 28, 2020 | An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags. | ||
| CVE-2020-10944 | Med | 0.35 | 5.4 | 0.01 | Apr 28, 2020 | HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. Fixed in 0.10.5. | ||
| CVE-2020-10094 | Med | 0.35 | 5.4 | 0.01 | Apr 28, 2020 | A cross-site scripting (XSS) vulnerability in Lexmark CS31x before LW74.VYL.P273; CS41x before LW74.VY2.P273; CS51x before LW74.VY4.P273; CX310 before LW74.GM2.P273; CX410 & XC2130 before LW74.GM4.P273; CX510 & XC2132 before LW74.GM7.P273; MS310, MS312, MS317 before… | ||
| CVE-2020-10093 | Med | 0.35 | 5.4 | 0.01 | Apr 28, 2020 | A cross-site scripting (XSS) vulnerability in Lexmark Pro910 series inkjet and other discontinued products. | ||
| CVE-2020-5570 | Med | 0.35 | 5.4 | 0.01 | Apr 28, 2020 | Cross-site scripting vulnerability in Sales Force Assistant version 11.2.48 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2019-18223 | Med | 0.35 | 5.4 | 0.01 | Apr 27, 2020 | ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the (1) User Edit or (2) User Add form, (3) name field in the Role Add form, (4) name or number field in the Edit Group form, (5) tagKey or… | ||
| CVE-2020-7132 | Med | 0.35 | 5.4 | 0.01 | Apr 23, 2020 | A potential security vulnerability has been identified in HPE Onboard Administrator. The vulnerability could be remotely exploited to allow Reflected Cross Site Scripting. HPE has made the following software updates and mitigation information to resolve the vulnerability in HPE… | ||
| CVE-2020-11416 | Med | 0.35 | 5.4 | 0.01 | Apr 22, 2020 | JetBrains Space through 2020-04-22 allows stored XSS in Chats. | ||
| CVE-2020-10935 | Med | 0.35 | 5.4 | 0.01 | Apr 20, 2020 | Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover. | ||
| CVE-2020-5737 | Med | 0.35 | 5.4 | 0.01 | Apr 17, 2020 | Stored XSS in Tenable.Sc before 5.14.0 could allow an authenticated remote attacker to craft a request to execute arbitrary script code in a user's browser session. Updated input validation techniques have been implemented to correct this issue. | ||
| CVE-2019-4749 | Med | 0.35 | 5.4 | 0.01 | Apr 17, 2020 | IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2019-20738 | Med | 0.35 | 5.4 | 0.01 | Apr 16, 2020 | Certain NETGEAR devices are affected by stored XSS. This affects D6100 before 1.0.0.58, D7800 before 1.0.1.34, JNR1010v2 before 1.1.0.50, JWNR2010v5 before 1.1.0.50, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, R6020 before 1.0.0.30, R6080 before… | ||
| CVE-2020-11823 | Med | 0.35 | 5.4 | 0.01 | Apr 16, 2020 | In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. This may lead to stealing of the admin account. | ||
| CVE-2020-11813 | Med | 0.35 | 5.4 | 0.01 | Apr 16, 2020 | In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous. | ||
| CVE-2019-19390 | Med | 0.35 | 5.4 | 0.01 | Apr 15, 2020 | The Search parameter of the Software Catalogue section of Matrix42 Workspace Management 9.1.2.2765 and below accepts unfiltered parameters that lead to multiple reflected XSS issues. | ||
| CVE-2020-4268 | Med | 0.35 | 5.4 | 0.01 | Apr 15, 2020 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2020-1049 | Med | 0.35 | 5.4 | 0.01 | Apr 15, 2020 | A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability'. This CVE ID is unique… |
- risk 0.35cvss 5.4epss 0.01
On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client.
- risk 0.35cvss 5.4epss 0.01
MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description.
- risk 0.35cvss 5.4epss 0.01
SUAP V2 allows XSS during the update of user information.
- risk 0.35cvss 5.4epss 0.01
An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags.
- risk 0.35cvss 5.4epss 0.01
HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. Fixed in 0.10.5.
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in Lexmark CS31x before LW74.VYL.P273; CS41x before LW74.VY2.P273; CS51x before LW74.VY4.P273; CX310 before LW74.GM2.P273; CX410 & XC2130 before LW74.GM4.P273; CX510 & XC2132 before LW74.GM7.P273; MS310, MS312, MS317 before…
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in Lexmark Pro910 series inkjet and other discontinued products.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting vulnerability in Sales Force Assistant version 11.2.48 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.35cvss 5.4epss 0.01
ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the (1) User Edit or (2) User Add form, (3) name field in the Role Add form, (4) name or number field in the Edit Group form, (5) tagKey or…
- risk 0.35cvss 5.4epss 0.01
A potential security vulnerability has been identified in HPE Onboard Administrator. The vulnerability could be remotely exploited to allow Reflected Cross Site Scripting. HPE has made the following software updates and mitigation information to resolve the vulnerability in HPE…
- risk 0.35cvss 5.4epss 0.01
JetBrains Space through 2020-04-22 allows stored XSS in Chats.
- risk 0.35cvss 5.4epss 0.01
Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.
- risk 0.35cvss 5.4epss 0.01
Stored XSS in Tenable.Sc before 5.14.0 could allow an authenticated remote attacker to craft a request to execute arbitrary script code in a user's browser session. Updated input validation techniques have been implemented to correct this issue.
- risk 0.35cvss 5.4epss 0.01
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.35cvss 5.4epss 0.01
Certain NETGEAR devices are affected by stored XSS. This affects D6100 before 1.0.0.58, D7800 before 1.0.1.34, JNR1010v2 before 1.1.0.50, JWNR2010v5 before 1.1.0.50, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, R6020 before 1.0.0.30, R6080 before…
- risk 0.35cvss 5.4epss 0.01
In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. This may lead to stealing of the admin account.
- risk 0.35cvss 5.4epss 0.01
In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous.
- risk 0.35cvss 5.4epss 0.01
The Search parameter of the Software Catalogue section of Matrix42 Workspace Management 9.1.2.2765 and below accepts unfiltered parameters that lead to multiple reflected XSS issues.
- risk 0.35cvss 5.4epss 0.01
IBM QRadar 7.3.0 to 7.3.3 Patch 2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.35cvss 5.4epss 0.01
A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability'. This CVE ID is unique…