CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1541 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-8953 | Med | 0.35 | 5.4 | 0.01 | Feb 15, 2018 | A Remote Cross-Site Scripting (XSS) vulnerability in HPE LoadRunner v12.53 and earlier and HPE Performance Center version v12.53 and earlier was found. | ||
| CVE-2017-5827 | Med | 0.35 | 5.4 | 0.01 | Feb 15, 2018 | A reflected cross site scripting vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found. | ||
| CVE-2017-5800 | Med | 0.35 | 5.4 | 0.01 | Feb 15, 2018 | A Remote Cross-Site Scripting (XSS) vulnerability in HPE Operations Bridge Analytics version v3.0 was found. | ||
| CVE-2017-12544 | Med | 0.35 | 5.4 | 0.05 | Feb 15, 2018 | A cross-site scripting vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found. | ||
| CVE-2016-8532 | Med | 0.35 | 5.4 | 0.01 | Feb 15, 2018 | A cross site scripting vulnerability in HPE Matrix Operating Environment version 7.6 was found. | ||
| CVE-2016-8522 | Med | 0.35 | 5.4 | 0.01 | Feb 15, 2018 | A cross-site scripting vulnerability in HPE Diagnostics version 9.24 IP1, 9.26 , 9.26IP1 was found. | ||
| CVE-2014-0013 | Med | 0.35 | 5.4 | 0.01 | Feb 15, 2018 | Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application that contains templates whose context is set to a… | ||
| CVE-2018-0869 | Med | 0.35 | 5.4 | 0.02 | Feb 15, 2018 | SharePoint Server 2016 allows an elevation of privilege vulnerability due to how web requests are handled, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". | ||
| CVE-2018-0864 | Med | 0.35 | 5.4 | 0.03 | Feb 15, 2018 | SharePoint Project Server 2013 and SharePoint Enterprise Server 2016 allow an information disclosure vulnerability due to how web requests are handled, aka "Microsoft SharePoint Information Disclosure Vulnerability". | ||
| CVE-2017-1682 | Med | 0.35 | 5.4 | 0.01 | Feb 14, 2018 | IBM Connections 4.0, 4.5, 5.0, 5.5, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.… | ||
| CVE-2017-18177 | Med | 0.35 | 5.4 | 0.01 | Feb 12, 2018 | Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1. | ||
| CVE-2017-18176 | Med | 0.35 | 5.4 | 0.01 | Feb 12, 2018 | Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. This is fixed in 10.1. | ||
| CVE-2017-18175 | Med | 0.35 | 5.4 | 0.01 | Feb 12, 2018 | Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src attribute of an IMG element. This is fixed in 10.1. | ||
| CVE-2018-6864 | Med | 0.35 | 5.4 | 0.01 | Feb 12, 2018 | Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter. | ||
| CVE-2018-6862 | Med | 0.35 | 5.4 | 0.01 | Feb 12, 2018 | Cross Site Scripting (XSS) exists in PHP Scripts Mall Bitcoin MLM Software 1.0.2 via a profile field. | ||
| CVE-2018-6861 | Med | 0.35 | 5.4 | 0.01 | Feb 12, 2018 | Cross Site Scripting (XSS) exists in PHP Scripts Mall Lawyer Search Script 1.0.2 via a profile update parameter. | ||
| CVE-2018-6858 | Med | 0.35 | 5.4 | 0.01 | Feb 12, 2018 | Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script. | ||
| CVE-2017-1000510 | Med | 0.35 | 5.4 | 0.01 | Feb 9, 2018 | Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code. | ||
| CVE-2017-1000509 | Med | 0.35 | 5.4 | 0.01 | Feb 9, 2018 | Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code. | ||
| CVE-2017-1000507 | Med | 0.35 | 5.4 | 0.01 | Feb 9, 2018 | Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and execution of javascript code. |
- risk 0.35cvss 5.4epss 0.01
A Remote Cross-Site Scripting (XSS) vulnerability in HPE LoadRunner v12.53 and earlier and HPE Performance Center version v12.53 and earlier was found.
- risk 0.35cvss 5.4epss 0.01
A reflected cross site scripting vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
- risk 0.35cvss 5.4epss 0.01
A Remote Cross-Site Scripting (XSS) vulnerability in HPE Operations Bridge Analytics version v3.0 was found.
- risk 0.35cvss 5.4epss 0.05
A cross-site scripting vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
- risk 0.35cvss 5.4epss 0.01
A cross site scripting vulnerability in HPE Matrix Operating Environment version 7.6 was found.
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting vulnerability in HPE Diagnostics version 9.24 IP1, 9.26 , 9.26IP1 was found.
- risk 0.35cvss 5.4epss 0.01
Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application that contains templates whose context is set to a…
- risk 0.35cvss 5.4epss 0.02
SharePoint Server 2016 allows an elevation of privilege vulnerability due to how web requests are handled, aka "Microsoft SharePoint Elevation of Privilege Vulnerability".
- risk 0.35cvss 5.4epss 0.03
SharePoint Project Server 2013 and SharePoint Enterprise Server 2016 allow an information disclosure vulnerability due to how web requests are handled, aka "Microsoft SharePoint Information Disclosure Vulnerability".
- risk 0.35cvss 5.4epss 0.01
IBM Connections 4.0, 4.5, 5.0, 5.5, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.…
- risk 0.35cvss 5.4epss 0.01
Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1.
- risk 0.35cvss 5.4epss 0.01
Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. This is fixed in 10.1.
- risk 0.35cvss 5.4epss 0.01
Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src attribute of an IMG element. This is fixed in 10.1.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in PHP Scripts Mall Bitcoin MLM Software 1.0.2 via a profile field.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in PHP Scripts Mall Lawyer Search Script 1.0.2 via a profile update parameter.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script.
- risk 0.35cvss 5.4epss 0.01
Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code.
- risk 0.35cvss 5.4epss 0.01
Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code.
- risk 0.35cvss 5.4epss 0.01
Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and execution of javascript code.