CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1500 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-16416 | Med | 0.35 | 5.4 | 0.01 | Oct 8, 2019 | HRworks 3.36.9 allows XSS via the purpose of a travel-expense report. | ||
| CVE-2019-17204 | Med | 0.35 | 5.4 | 0.01 | Oct 5, 2019 | TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item. | ||
| CVE-2019-17203 | Med | 0.35 | 5.4 | 0.01 | Oct 5, 2019 | TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder. | ||
| CVE-2019-11656 | Med | 0.35 | 5.4 | 0.01 | Oct 4, 2019 | Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0. This vulnerability could allow Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). | ||
| CVE-2019-17121 | Med | 0.35 | 5.4 | 0.01 | Oct 4, 2019 | REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values. | ||
| CVE-2019-8289 | Med | 0.35 | 5.4 | 0.01 | Oct 1, 2019 | Vulnerability in Online Store v1.0, stored XSS in admin/user_view.php adidas_member_email variable | ||
| CVE-2019-8288 | Med | 0.35 | 5.4 | 0.01 | Oct 1, 2019 | Vulnerability in Online Store v1.0, Stored XSS in user_view.php where adidas_member_user variable is not sanitized. | ||
| CVE-2019-17074 | Med | 0.35 | 5.4 | 0.01 | Oct 1, 2019 | An issue was discovered in XunRuiCMS 4.3.1. There is a stored XSS in the module_category area. | ||
| CVE-2019-4497 | Med | 0.35 | 5.4 | 0.01 | Oct 1, 2019 | IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to… | ||
| CVE-2019-4495 | Med | 0.35 | 5.4 | 0.01 | Oct 1, 2019 | IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to… | ||
| CVE-2019-4494 | Med | 0.35 | 5.4 | 0.01 | Oct 1, 2019 | IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to… | ||
| CVE-2019-4115 | Med | 0.35 | 5.4 | 0.01 | Sep 30, 2019 | IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2019-16688 | Med | 0.35 | 5.4 | 0.01 | Sep 27, 2019 | Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no permissions.) | ||
| CVE-2019-16687 | Med | 0.35 | 5.4 | 0.01 | Sep 27, 2019 | Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation. | ||
| CVE-2019-16686 | Med | 0.35 | 5.4 | 0.01 | Sep 27, 2019 | Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin. | ||
| CVE-2019-16685 | Med | 0.35 | 5.4 | 0.01 | Sep 27, 2019 | Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation. | ||
| CVE-2019-16904 | Med | 0.35 | 5.4 | 0.01 | Sep 26, 2019 | TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. (The crafted password is exploitable when viewing the change history of the item or tapping on the item.) | ||
| CVE-2019-14272 | Med | 0.35 | 5.4 | 0.01 | Sep 26, 2019 | In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS. | ||
| CVE-2015-9438 | Med | 0.35 | 5.4 | 0.01 | Sep 26, 2019 | The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter. | ||
| CVE-2015-9436 | Med | 0.35 | 5.4 | 0.01 | Sep 26, 2019 | The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter. |
- risk 0.35cvss 5.4epss 0.01
HRworks 3.36.9 allows XSS via the purpose of a travel-expense report.
- risk 0.35cvss 5.4epss 0.01
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item.
- risk 0.35cvss 5.4epss 0.01
TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.
- risk 0.35cvss 5.4epss 0.01
Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0. This vulnerability could allow Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
- risk 0.35cvss 5.4epss 0.01
REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values.
- risk 0.35cvss 5.4epss 0.01
Vulnerability in Online Store v1.0, stored XSS in admin/user_view.php adidas_member_email variable
- risk 0.35cvss 5.4epss 0.01
Vulnerability in Online Store v1.0, Stored XSS in user_view.php where adidas_member_user variable is not sanitized.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in XunRuiCMS 4.3.1. There is a stored XSS in the module_category area.
- risk 0.35cvss 5.4epss 0.01
IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
- risk 0.35cvss 5.4epss 0.01
IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
- risk 0.35cvss 5.4epss 0.01
IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
- risk 0.35cvss 5.4epss 0.01
IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.35cvss 5.4epss 0.01
Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no permissions.)
- risk 0.35cvss 5.4epss 0.01
Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.
- risk 0.35cvss 5.4epss 0.01
Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin.
- risk 0.35cvss 5.4epss 0.01
Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.
- risk 0.35cvss 5.4epss 0.01
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. (The crafted password is exploitable when viewing the change history of the item or tapping on the item.)
- risk 0.35cvss 5.4epss 0.01
In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS.
- risk 0.35cvss 5.4epss 0.01
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.
- risk 0.35cvss 5.4epss 0.01
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.