CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1506 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-18471 | Med | 0.35 | 5.4 | 0.01 | Aug 5, 2019 | cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197). | ||
| CVE-2016-10774 | Med | 0.35 | 5.4 | 0.01 | Aug 5, 2019 | cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172). | ||
| CVE-2016-10767 | Med | 0.35 | 5.4 | 0.01 | Aug 5, 2019 | cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159). | ||
| CVE-2019-7874 | Med | 0.35 | 6.5 | 0.00 | Aug 2, 2019 | A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles. | ||
| CVE-2017-18454 | Med | 0.35 | 5.4 | 0.01 | Aug 2, 2019 | cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262). | ||
| CVE-2017-18420 | Med | 0.35 | 5.4 | 0.01 | Aug 2, 2019 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269). | ||
| CVE-2017-18419 | Med | 0.35 | 5.4 | 0.01 | Aug 2, 2019 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266). | ||
| CVE-2017-18418 | Med | 0.35 | 5.4 | 0.01 | Aug 2, 2019 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265). | ||
| CVE-2017-18417 | Med | 0.35 | 5.4 | 0.01 | Aug 2, 2019 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263). | ||
| CVE-2017-18408 | Med | 0.35 | 5.4 | 0.01 | Aug 2, 2019 | cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282). | ||
| CVE-2017-18402 | Med | 0.35 | 5.4 | 0.01 | Aug 2, 2019 | cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336). | ||
| CVE-2016-10813 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118). | ||
| CVE-2016-10827 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96). | ||
| CVE-2016-10822 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88). | ||
| CVE-2018-20935 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action (SEC-412). | ||
| CVE-2018-20933 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action (SEC-410). | ||
| CVE-2018-20916 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370). | ||
| CVE-2018-20915 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369). | ||
| CVE-2016-10854 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87). | ||
| CVE-2016-10853 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86). |
- risk 0.35cvss 5.4epss 0.01
cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).
- risk 0.35cvss 5.4epss 0.01
cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172).
- risk 0.35cvss 5.4epss 0.01
cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159).
- risk 0.35cvss 6.5epss 0.00
A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles.
- risk 0.35cvss 5.4epss 0.01
cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).
- risk 0.35cvss 5.4epss 0.01
cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269).
- risk 0.35cvss 5.4epss 0.01
cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).
- risk 0.35cvss 5.4epss 0.01
cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).
- risk 0.35cvss 5.4epss 0.01
cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).
- risk 0.35cvss 5.4epss 0.01
cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282).
- risk 0.35cvss 5.4epss 0.01
cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).
- risk 0.35cvss 5.4epss 0.01
cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118).
- risk 0.35cvss 5.4epss 0.01
cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).
- risk 0.35cvss 5.4epss 0.01
cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88).
- risk 0.35cvss 5.4epss 0.01
cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action (SEC-412).
- risk 0.35cvss 5.4epss 0.01
cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action (SEC-410).
- risk 0.35cvss 5.4epss 0.01
cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370).
- risk 0.35cvss 5.4epss 0.01
cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369).
- risk 0.35cvss 5.4epss 0.01
cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87).
- risk 0.35cvss 5.4epss 0.01
cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86).