CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1537 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-7659 | Med | 0.35 | 5.4 | 0.01 | Apr 11, 2018 | In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Stored Cross-Site Scripting Vulnerability could potentially be exploited by malicious users to compromise the affected system via a filename of an uploaded image file. | ||
| CVE-2017-9838 | Med | 0.35 | 5.4 | 0.01 | Apr 11, 2018 | Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and… | ||
| CVE-2017-18259 | Med | 0.35 | 5.4 | 0.01 | Apr 11, 2018 | Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0. | ||
| CVE-2018-2410 | Med | 0.35 | 5.4 | 0.01 | Apr 10, 2018 | SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2018-2405 | Med | 0.35 | 5.4 | 0.01 | Apr 10, 2018 | SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possible Cross-Site Scripting. | ||
| CVE-2018-9925 | Med | 0.35 | 5.4 | 0.01 | Apr 10, 2018 | An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request. | ||
| CVE-2018-9330 | Med | 0.35 | 5.4 | 0.01 | Apr 7, 2018 | register.jsp in Coremail XT3.0 allows stored XSS, as demonstrated by the third form field to a URI under register/, a different vulnerability than CVE-2015-6942. | ||
| CVE-2017-18097 | Med | 0.35 | 5.4 | 0.01 | Apr 6, 2018 | The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello board to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the title of a Trello… | ||
| CVE-2018-1081 | Med | 0.35 | 5.3 | 0.01 | Apr 4, 2018 | A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after… | ||
| CVE-2018-1390 | Med | 0.35 | 5.4 | 0.01 | Mar 30, 2018 | IBM Financial Transaction Manager for Check Services for Multi-Platform 3.0, 3.0.2, and 3.0.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to… | ||
| CVE-2018-1384 | Med | 0.35 | 5.4 | 0.01 | Mar 30, 2018 | IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2017-1767 | Med | 0.35 | 5.4 | 0.01 | Mar 30, 2018 | IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2018-9123 | Med | 0.35 | 5.4 | 0.01 | Mar 29, 2018 | In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile. | ||
| CVE-2018-9122 | Med | 0.35 | 5.4 | 0.01 | Mar 29, 2018 | In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI. | ||
| CVE-2018-9121 | Med | 0.35 | 5.4 | 0.01 | Mar 29, 2018 | In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment. | ||
| CVE-2018-9120 | Med | 0.35 | 5.4 | 0.01 | Mar 29, 2018 | In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post. | ||
| CVE-2018-1142 | Med | 0.35 | 5.4 | 0.01 | Mar 28, 2018 | Tenable Appliance versions 4.6.1 and earlier have been found to contain a single XSS vulnerability. Utilizing a specially crafted request, an authenticated attacker could potentially execute arbitrary JavaScript code by manipulating certain URL parameters related to offline… | ||
| CVE-2015-7423 | Med | 0.35 | 5.4 | 0.01 | Mar 26, 2018 | Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 107771. | ||
| CVE-2018-9020 | Med | 0.35 | 5.4 | 0.01 | Mar 26, 2018 | The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature. | ||
| CVE-2018-8978 | Med | 0.35 | 5.4 | 0.01 | Mar 25, 2018 | Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI. |
- risk 0.35cvss 5.4epss 0.01
In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Stored Cross-Site Scripting Vulnerability could potentially be exploited by malicious users to compromise the affected system via a filename of an uploaded image file.
- risk 0.35cvss 5.4epss 0.01
Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and…
- risk 0.35cvss 5.4epss 0.01
Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.
- risk 0.35cvss 5.4epss 0.01
SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability.
- risk 0.35cvss 5.4epss 0.01
SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possible Cross-Site Scripting.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request.
- risk 0.35cvss 5.4epss 0.01
register.jsp in Coremail XT3.0 allows stored XSS, as demonstrated by the third form field to a URI under register/, a different vulnerability than CVE-2015-6942.
- risk 0.35cvss 5.4epss 0.01
The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello board to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the title of a Trello…
- risk 0.35cvss 5.3epss 0.01
A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after…
- risk 0.35cvss 5.4epss 0.01
IBM Financial Transaction Manager for Check Services for Multi-Platform 3.0, 3.0.2, and 3.0.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
- risk 0.35cvss 5.4epss 0.01
IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.35cvss 5.4epss 0.01
IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.35cvss 5.4epss 0.01
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile.
- risk 0.35cvss 5.4epss 0.01
In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI.
- risk 0.35cvss 5.4epss 0.01
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment.
- risk 0.35cvss 5.4epss 0.01
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post.
- risk 0.35cvss 5.4epss 0.01
Tenable Appliance versions 4.6.1 and earlier have been found to contain a single XSS vulnerability. Utilizing a specially crafted request, an authenticated attacker could potentially execute arbitrary JavaScript code by manipulating certain URL parameters related to offline…
- risk 0.35cvss 5.4epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 107771.
- risk 0.35cvss 5.4epss 0.01
The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.
- risk 0.35cvss 5.4epss 0.01
Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI.