CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1527 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-7795 | Med | 0.35 | 5.4 | 0.02 | Aug 29, 2018 | A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of… | ||
| CVE-2018-15896 | Med | 0.35 | 5.4 | 0.01 | Aug 28, 2018 | PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name. | ||
| CVE-2018-1394 | Med | 0.35 | 5.4 | 0.01 | Aug 20, 2018 | Multiple IBM Rational products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2018-1000219 | Med | 0.35 | 5.4 | 0.01 | Aug 20, 2018 | OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'scan' parameter in line #41 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack… | ||
| CVE-2018-1000218 | Med | 0.35 | 5.4 | 0.01 | Aug 20, 2018 | OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack… | ||
| CVE-2018-1715 | Med | 0.35 | 5.4 | 0.01 | Aug 16, 2018 | IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.… | ||
| CVE-2018-0367 | Med | 0.35 | 5.4 | 0.01 | Aug 15, 2018 | A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. The… | ||
| CVE-2018-3781 | Med | 0.35 | 5.4 | 0.01 | Aug 13, 2018 | A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users. | ||
| CVE-2018-3780 | Med | 0.35 | 5.4 | 0.01 | Aug 13, 2018 | A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users. | ||
| CVE-2018-14850 | Med | 0.35 | 5.4 | 0.01 | Aug 13, 2018 | Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image. | ||
| CVE-2018-14849 | Med | 0.35 | 5.4 | 0.01 | Aug 13, 2018 | Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php. | ||
| CVE-2018-15190 | Med | 0.35 | 5.4 | 0.01 | Aug 10, 2018 | PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name, Last Name, or Address field. | ||
| CVE-2018-15189 | Med | 0.35 | 5.4 | 0.01 | Aug 10, 2018 | PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile. | ||
| CVE-2018-15184 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2018 | PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795. | ||
| CVE-2018-15182 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2018 | PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields. | ||
| CVE-2018-15199 | Med | 0.35 | 5.4 | 0.01 | Aug 8, 2018 | AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action. | ||
| CVE-2018-15130 | Med | 0.35 | 5.4 | 0.01 | Aug 7, 2018 | ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter. | ||
| CVE-2018-1690 | Med | 0.35 | 5.4 | 0.01 | Aug 7, 2018 | IBM Rhapsody Model Manager 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2018-15129 | Med | 0.35 | 5.4 | 0.01 | Aug 7, 2018 | ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter. | ||
| CVE-2017-8991 | Med | 0.35 | 5.4 | 0.01 | Aug 6, 2018 | HPE has identified a cross site scripting (XSS) vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version. |
- risk 0.35cvss 5.4epss 0.02
A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of…
- risk 0.35cvss 5.4epss 0.01
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name.
- risk 0.35cvss 5.4epss 0.01
Multiple IBM Rational products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.35cvss 5.4epss 0.01
OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'scan' parameter in line #41 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack…
- risk 0.35cvss 5.4epss 0.01
OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack…
- risk 0.35cvss 5.4epss 0.01
IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.…
- risk 0.35cvss 5.4epss 0.01
A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. The…
- risk 0.35cvss 5.4epss 0.01
A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.
- risk 0.35cvss 5.4epss 0.01
A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.
- risk 0.35cvss 5.4epss 0.01
Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image.
- risk 0.35cvss 5.4epss 0.01
Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php.
- risk 0.35cvss 5.4epss 0.01
PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name, Last Name, or Address field.
- risk 0.35cvss 5.4epss 0.01
PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile.
- risk 0.35cvss 5.4epss 0.01
PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795.
- risk 0.35cvss 5.4epss 0.01
PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields.
- risk 0.35cvss 5.4epss 0.01
AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action.
- risk 0.35cvss 5.4epss 0.01
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter.
- risk 0.35cvss 5.4epss 0.01
IBM Rhapsody Model Manager 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.35cvss 5.4epss 0.01
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter.
- risk 0.35cvss 5.4epss 0.01
HPE has identified a cross site scripting (XSS) vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.