CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1493 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2013-3067 | Med | 0.35 | 5.4 | 0.01 | Feb 7, 2020 | Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS. | ||
| CVE-2013-3637 | Med | 0.35 | 5.4 | 0.01 | Feb 7, 2020 | ProjectPier 0.8.8 does not use the Secure flag for cookies | ||
| CVE-2013-3636 | Med | 0.35 | 5.4 | 0.01 | Feb 7, 2020 | ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag | ||
| CVE-2013-3635 | Med | 0.35 | 5.4 | 0.01 | Feb 7, 2020 | ProjectPier 0.8.8 has stored XSS | ||
| CVE-2020-6854 | Med | 0.35 | 5.4 | 0.01 | Feb 5, 2020 | A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbitrary web script or HTML via JSON properties available from the REST API. | ||
| CVE-2019-15614 | Med | 0.35 | 5.4 | 0.01 | Feb 4, 2020 | Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files. | ||
| CVE-2015-3612 | Med | 0.35 | 5.4 | 0.01 | Feb 4, 2020 | A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in the FortiWeb auto update service page. | ||
| CVE-2019-4451 | Med | 0.35 | 5.4 | 0.01 | Feb 4, 2020 | IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2019-19968 | Med | 0.35 | 5.4 | 0.01 | Feb 4, 2020 | PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user can inject dangerous content into a data store that is later read and included in dynamic content. | ||
| CVE-2020-8498 | Med | 0.35 | 5.4 | 0.01 | Jan 30, 2020 | XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users… | ||
| CVE-2020-7910 | Med | 0.35 | 5.4 | 0.01 | Jan 30, 2020 | JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role. | ||
| CVE-2019-7655 | Med | 0.35 | 5.4 | 0.01 | Jan 29, 2020 | Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in enginemanager/server/serversetup/edit_adv.htm of the Server Setup configuration or the (2) host field in enginemanager/j_spring_security_check of… | ||
| CVE-2012-5776 | Med | 0.35 | 5.4 | 0.01 | Jan 29, 2020 | Dokeos 2.1.1 has multiple XSS issues involving "extra_" parameters in main/auth/profile.php. | ||
| CVE-2020-8426 | Med | 0.35 | 5.4 | 0.01 | Jan 28, 2020 | The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user. | ||
| CVE-2019-17338 | Med | 0.35 | 5.4 | 0.01 | Jan 28, 2020 | The user interface component of TIBCO Software Inc.'s TIBCO Patterns - Search contains multiple vulnerabilities that theoretically allow authenticated users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Patterns -… | ||
| CVE-2019-15607 | Med | 0.35 | 5.4 | 0.01 | Jan 28, 2020 | A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc. | ||
| CVE-2019-17651 | Med | 0.35 | 5.4 | 0.01 | Jan 28, 2020 | An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and below may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious… | ||
| CVE-2019-11318 | Med | 0.35 | 5.4 | 0.01 | Jan 27, 2020 | Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS. | ||
| CVE-2015-2249 | Med | 0.35 | 5.4 | 0.01 | Jan 27, 2020 | Zimbra Collaboration before 8.6.0 patch5 has XSS. | ||
| CVE-2013-0286 | Med | 0.35 | 5.4 | 0.01 | Jan 27, 2020 | Pinboard 1.0.6 theme for Wordpress has XSS. |
- risk 0.35cvss 5.4epss 0.01
Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS.
- risk 0.35cvss 5.4epss 0.01
ProjectPier 0.8.8 does not use the Secure flag for cookies
- risk 0.35cvss 5.4epss 0.01
ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag
- risk 0.35cvss 5.4epss 0.01
ProjectPier 0.8.8 has stored XSS
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbitrary web script or HTML via JSON properties available from the REST API.
- risk 0.35cvss 5.4epss 0.01
Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.
- risk 0.35cvss 5.4epss 0.01
A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in the FortiWeb auto update service page.
- risk 0.35cvss 5.4epss 0.01
IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.35cvss 5.4epss 0.01
PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user can inject dangerous content into a data store that is later read and included in dynamic content.
- risk 0.35cvss 5.4epss 0.01
XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users…
- risk 0.35cvss 5.4epss 0.01
JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.
- risk 0.35cvss 5.4epss 0.01
Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in enginemanager/server/serversetup/edit_adv.htm of the Server Setup configuration or the (2) host field in enginemanager/j_spring_security_check of…
- risk 0.35cvss 5.4epss 0.01
Dokeos 2.1.1 has multiple XSS issues involving "extra_" parameters in main/auth/profile.php.
- risk 0.35cvss 5.4epss 0.01
The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user.
- risk 0.35cvss 5.4epss 0.01
The user interface component of TIBCO Software Inc.'s TIBCO Patterns - Search contains multiple vulnerabilities that theoretically allow authenticated users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Patterns -…
- risk 0.35cvss 5.4epss 0.01
A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc.
- risk 0.35cvss 5.4epss 0.01
An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and below may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious…
- risk 0.35cvss 5.4epss 0.01
Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS.
- risk 0.35cvss 5.4epss 0.01
Zimbra Collaboration before 8.6.0 patch5 has XSS.
- risk 0.35cvss 5.4epss 0.01
Pinboard 1.0.6 theme for Wordpress has XSS.