CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1504 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-3418 | Med | 0.35 | 5.4 | 0.01 | Aug 15, 2019 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by cross-site scripting vulnerability (XSS). Due to incomplete input validation, an authorized user can exploit this vulnerability to execute malicious scripts. | ||
| CVE-2019-1218 | Med | 0.35 | 5.4 | 0.04 | Aug 14, 2019 | A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this… | ||
| CVE-2019-1203 | Med | 0.35 | 5.4 | 0.02 | Aug 14, 2019 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an… | ||
| CVE-2019-0334 | Med | 0.35 | 5.4 | 0.01 | Aug 14, 2019 | When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script which when executed later could potentially allow a user to escalate privileges via session hijacking. The attacker… | ||
| CVE-2019-14947 | Med | 0.35 | 5.4 | 0.01 | Aug 12, 2019 | The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade. | ||
| CVE-2019-14946 | Med | 0.35 | 5.4 | 0.01 | Aug 12, 2019 | The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations. | ||
| CVE-2019-14945 | Med | 0.35 | 5.4 | 0.01 | Aug 12, 2019 | The ultimate-member plugin before 2.0.54 for WordPress has XSS. | ||
| CVE-2019-14948 | Med | 0.35 | 5.4 | 0.01 | Aug 12, 2019 | The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure. | ||
| CVE-2018-20827 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2019 | The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter. | ||
| CVE-2019-5398 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2019 | A remote multiple multiple cross-site vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. | ||
| CVE-2019-14797 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2019 | The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS. | ||
| CVE-2019-14796 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2019 | The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter. | ||
| CVE-2019-14792 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2019 | The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter. | ||
| CVE-2019-14787 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2019 | The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter. | ||
| CVE-2019-14785 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2019 | The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter. | ||
| CVE-2019-10374 | Med | 0.35 | 5.4 | 0.01 | Aug 7, 2019 | A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI. | ||
| CVE-2019-10373 | Med | 0.35 | 5.4 | 0.01 | Aug 7, 2019 | A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipeline description to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins. | ||
| CVE-2016-10806 | Med | 0.35 | 5.4 | 0.01 | Aug 7, 2019 | cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110). | ||
| CVE-2019-14731 | Med | 0.35 | 5.4 | 0.01 | Aug 7, 2019 | An issue was discovered in ZenTao 11.5.1. There is an XSS (stored) vulnerability that leads to the capture of other people's cookies via the Rich Text Box. | ||
| CVE-2019-12950 | Med | 0.35 | 5.4 | 0.01 | Aug 6, 2019 | An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php "Import items" feature, it is possible to load a crafted CSV file with an XSS payload. |
- risk 0.35cvss 5.4epss 0.01
All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by cross-site scripting vulnerability (XSS). Due to incomplete input validation, an authorized user can exploit this vulnerability to execute malicious scripts.
- risk 0.35cvss 5.4epss 0.04
A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this…
- risk 0.35cvss 5.4epss 0.02
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an…
- risk 0.35cvss 5.4epss 0.01
When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script which when executed later could potentially allow a user to escalate privileges via session hijacking. The attacker…
- risk 0.35cvss 5.4epss 0.01
The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.
- risk 0.35cvss 5.4epss 0.01
The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.
- risk 0.35cvss 5.4epss 0.01
The ultimate-member plugin before 2.0.54 for WordPress has XSS.
- risk 0.35cvss 5.4epss 0.01
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.
- risk 0.35cvss 5.4epss 0.01
The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter.
- risk 0.35cvss 5.4epss 0.01
A remote multiple multiple cross-site vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
- risk 0.35cvss 5.4epss 0.01
The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.
- risk 0.35cvss 5.4epss 0.01
The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter.
- risk 0.35cvss 5.4epss 0.01
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.
- risk 0.35cvss 5.4epss 0.01
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.
- risk 0.35cvss 5.4epss 0.01
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter.
- risk 0.35cvss 5.4epss 0.01
A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI.
- risk 0.35cvss 5.4epss 0.01
A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipeline description to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
- risk 0.35cvss 5.4epss 0.01
cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in ZenTao 11.5.1. There is an XSS (stored) vulnerability that leads to the capture of other people's cookies via the Rich Text Box.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php "Import items" feature, it is possible to load a crafted CSV file with an XSS payload.