CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1539 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-1000129 | Med | 0.35 | 6.1 | 0.25 | Mar 14, 2018 | An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser. | ||
| CVE-2018-1444 | Med | 0.35 | 5.4 | 0.01 | Mar 14, 2018 | IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2018-1000084 | Med | 0.35 | 5.4 | 0.01 | Mar 13, 2018 | WOlfCMS WolfCMS version version 0.8.3.1 contains a Stored Cross-Site Scripting vulnerability in Layout Name (from Layout tab) that can result in low privilege user can steal the cookie of admin user and compromise the admin account. This attack appear to be exploitable via Need… | ||
| CVE-2018-1000113 | Med | 0.35 | 5.4 | 0.01 | Mar 13, 2018 | A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others that allow an attacker who can control e.g. TestLink report names to have Jenkins serve arbitrary HTML and JavaScript | ||
| CVE-2018-8078 | Med | 0.35 | 5.4 | 0.01 | Mar 13, 2018 | YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html. | ||
| CVE-2017-18228 | Med | 0.35 | 5.4 | 0.01 | Mar 12, 2018 | Remedy Mid Tier in BMC Remedy AR System 9.1 allows XSS via the ATTKey parameter in an arsys/servlet/AttachServlet request. | ||
| CVE-2016-0261 | Med | 0.35 | 5.4 | 0.01 | Mar 12, 2018 | Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP29, 6.0.4 before 6.0.4.6 iFix3, 6.0.5 before 6.0.5.9 iFix2, 6.1.0 before 6.1.0.1 iFix1, and 6.1.1 before 6.1.1.1 iFix1; and IBM Care Management 6.0 allows remote attackers to… | ||
| CVE-2018-8070 | Med | 0.35 | 5.4 | 0.01 | Mar 12, 2018 | QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI. | ||
| CVE-2018-8069 | Med | 0.35 | 5.4 | 0.01 | Mar 12, 2018 | QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI. | ||
| CVE-2018-7290 | Med | 0.35 | 5.4 | 0.01 | Mar 9, 2018 | Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1. | ||
| CVE-2016-0253 | Med | 0.35 | 5.4 | 0.01 | Mar 9, 2018 | Cross-site scripting (XSS) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial… | ||
| CVE-2018-0220 | Med | 0.35 | 5.4 | 0.01 | Mar 8, 2018 | A vulnerability in the web-based management interface of Cisco Videoscape AnyRes Live could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due… | ||
| CVE-2018-0208 | Med | 0.35 | 5.4 | 0.01 | Mar 8, 2018 | A vulnerability in the web-based management interface of the (cloud based) Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service.… | ||
| CVE-2014-8780 | Med | 0.35 | 5.4 | 0.01 | Mar 7, 2018 | Cross-site scripting (XSS) vulnerability in Jease 2.11 allows remote authenticated users to inject arbitrary web script or HTML via a content section note. | ||
| CVE-2018-7724 | Med | 0.35 | 5.4 | 0.00 | Mar 6, 2018 | The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request. CSRF exploitation, related to CVE-2017-10681, may be possible. | ||
| CVE-2018-7723 | Med | 0.35 | 5.4 | 0.01 | Mar 6, 2018 | The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list request, a different issue than CVE-2017-9836. CSRF exploitation, related to CVE-2017-10681, may be possible. | ||
| CVE-2018-7722 | Med | 0.35 | 5.4 | 0.01 | Mar 6, 2018 | The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. CSRF exploitation, related to CVE-2017-10681, may be possible. | ||
| CVE-2017-7427 | Med | 0.35 | 5.4 | 0.01 | Mar 5, 2018 | Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in… | ||
| CVE-2017-9276 | Med | 0.35 | 5.4 | 0.01 | Mar 2, 2018 | Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using the "a" parameter. | ||
| CVE-2017-14800 | Med | 0.35 | 5.4 | 0.01 | Mar 1, 2018 | A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the "typecontainerid" parameter of the policy editor could allowed code injection into pages of authenticated users. |
- risk 0.35cvss 6.1epss 0.25
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
- risk 0.35cvss 5.4epss 0.01
IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.35cvss 5.4epss 0.01
WOlfCMS WolfCMS version version 0.8.3.1 contains a Stored Cross-Site Scripting vulnerability in Layout Name (from Layout tab) that can result in low privilege user can steal the cookie of admin user and compromise the admin account. This attack appear to be exploitable via Need…
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others that allow an attacker who can control e.g. TestLink report names to have Jenkins serve arbitrary HTML and JavaScript
- risk 0.35cvss 5.4epss 0.01
YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html.
- risk 0.35cvss 5.4epss 0.01
Remedy Mid Tier in BMC Remedy AR System 9.1 allows XSS via the ATTKey parameter in an arsys/servlet/AttachServlet request.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP29, 6.0.4 before 6.0.4.6 iFix3, 6.0.5 before 6.0.5.9 iFix2, 6.1.0 before 6.1.0.1 iFix1, and 6.1.1 before 6.1.1.1 iFix1; and IBM Care Management 6.0 allows remote attackers to…
- risk 0.35cvss 5.4epss 0.01
QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI.
- risk 0.35cvss 5.4epss 0.01
QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial…
- risk 0.35cvss 5.4epss 0.01
A vulnerability in the web-based management interface of Cisco Videoscape AnyRes Live could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due…
- risk 0.35cvss 5.4epss 0.01
A vulnerability in the web-based management interface of the (cloud based) Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service.…
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in Jease 2.11 allows remote authenticated users to inject arbitrary web script or HTML via a content section note.
- risk 0.35cvss 5.4epss 0.00
The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request. CSRF exploitation, related to CVE-2017-10681, may be possible.
- risk 0.35cvss 5.4epss 0.01
The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list request, a different issue than CVE-2017-9836. CSRF exploitation, related to CVE-2017-10681, may be possible.
- risk 0.35cvss 5.4epss 0.01
The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. CSRF exploitation, related to CVE-2017-10681, may be possible.
- risk 0.35cvss 5.4epss 0.01
Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in…
- risk 0.35cvss 5.4epss 0.01
Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using the "a" parameter.
- risk 0.35cvss 5.4epss 0.01
A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the "typecontainerid" parameter of the policy editor could allowed code injection into pages of authenticated users.