CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1496 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-19679 | Med | 0.35 | 5.4 | 0.01 | Dec 9, 2019 | In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the Pre-Condition Summary entry point via the summary field of a Create Pre-Condition action for a new Test Issue. | ||
| CVE-2019-19678 | Med | 0.35 | 5.4 | 0.01 | Dec 9, 2019 | In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the generic field entry point via the Generic Test Definition field of a new Generic Test issue. | ||
| CVE-2013-0283 | Med | 0.35 | 5.4 | 0.01 | Dec 5, 2019 | Katello: Username in Notification page has cross site scripting | ||
| CVE-2019-19596 | Med | 0.35 | 5.4 | 0.01 | Dec 5, 2019 | GitBook through 2.6.9 allows XSS via a local .md file. | ||
| CVE-2019-18347 | Med | 0.35 | 5.4 | 0.01 | Dec 4, 2019 | A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected… | ||
| CVE-2019-19457 | Med | 0.35 | 5.4 | 0.01 | Dec 3, 2019 | SALTO ProAccess SPACE 5.4.3.0 allows XSS. | ||
| CVE-2019-4468 | Med | 0.35 | 5.4 | 0.01 | Dec 3, 2019 | IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2019-4467 | Med | 0.35 | 5.4 | 0.01 | Dec 3, 2019 | IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2019-4226 | Med | 0.35 | 5.4 | 0.01 | Dec 3, 2019 | IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2019-4098 | Med | 0.35 | 5.4 | 0.01 | Dec 3, 2019 | IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2013-2101 | Med | 0.35 | 5.4 | 0.01 | Dec 3, 2019 | Katello has multiple XSS issues in various entities | ||
| CVE-2019-19496 | Med | 0.35 | 5.4 | 0.01 | Dec 2, 2019 | Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document. | ||
| CVE-2019-14449 | Med | 0.35 | 5.4 | 0.01 | Nov 26, 2019 | An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting (XSS) when viewed within this product. | ||
| CVE-2016-9271 | Med | 0.35 | 5.4 | 0.01 | Nov 26, 2019 | Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature. | ||
| CVE-2019-19306 | Med | 0.35 | 5.4 | 0.01 | Nov 26, 2019 | The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName. | ||
| CVE-2019-19206 | Med | 0.35 | 5.4 | 0.01 | Nov 26, 2019 | Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture. | ||
| CVE-2015-9537 | Med | 0.35 | 5.4 | 0.01 | Nov 26, 2019 | The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template. | ||
| CVE-2015-4457 | Med | 0.35 | 5.4 | 0.01 | Nov 26, 2019 | Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors. | ||
| CVE-2019-15968 | Med | 0.35 | 5.4 | 0.01 | Nov 26, 2019 | A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager (Unified CDM) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected… | ||
| CVE-2011-3606 | Med | 0.35 | 5.4 | 0.01 | Nov 26, 2019 | A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which… |
- risk 0.35cvss 5.4epss 0.01
In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the Pre-Condition Summary entry point via the summary field of a Create Pre-Condition action for a new Test Issue.
- risk 0.35cvss 5.4epss 0.01
In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the generic field entry point via the Generic Test Definition field of a new Generic Test issue.
- risk 0.35cvss 5.4epss 0.01
Katello: Username in Notification page has cross site scripting
- risk 0.35cvss 5.4epss 0.01
GitBook through 2.6.9 allows XSS via a local .md file.
- risk 0.35cvss 5.4epss 0.01
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected…
- risk 0.35cvss 5.4epss 0.01
SALTO ProAccess SPACE 5.4.3.0 allows XSS.
- risk 0.35cvss 5.4epss 0.01
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.35cvss 5.4epss 0.01
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.35cvss 5.4epss 0.01
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.35cvss 5.4epss 0.01
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.35cvss 5.4epss 0.01
Katello has multiple XSS issues in various entities
- risk 0.35cvss 5.4epss 0.01
Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting (XSS) when viewed within this product.
- risk 0.35cvss 5.4epss 0.01
Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature.
- risk 0.35cvss 5.4epss 0.01
The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName.
- risk 0.35cvss 5.4epss 0.01
Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture.
- risk 0.35cvss 5.4epss 0.01
The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template.
- risk 0.35cvss 5.4epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors.
- risk 0.35cvss 5.4epss 0.01
A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager (Unified CDM) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected…
- risk 0.35cvss 5.4epss 0.01
A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which…