CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1545 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-17993 | Med | 0.35 | 5.4 | 0.01 | Dec 30, 2017 | Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=addition_deduction request. | ||
| CVE-2017-17991 | Med | 0.35 | 5.4 | 0.01 | Dec 30, 2017 | Biometric Shift Employee Management System has XSS via the expense_name parameter in an index.php?user=expenses request. | ||
| CVE-2017-17989 | Med | 0.35 | 5.4 | 0.01 | Dec 30, 2017 | Biometric Shift Employee Management System has XSS via the index.php holiday_name parameter in an edit_holiday action. | ||
| CVE-2017-17981 | Med | 0.35 | 5.4 | 0.00 | Dec 30, 2017 | PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter. | ||
| CVE-2017-15892 | Med | 0.35 | 5.4 | 0.01 | Dec 28, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbitrary web script or HTML via (1) COMMAND, (2) COMMANDS INSTRUCTION, or (3) DESCRIPTION parameter. | ||
| CVE-2017-17904 | Med | 0.35 | 5.4 | 0.00 | Dec 27, 2017 | FS Lynda Clone has XSS via the keywords parameter to tutorial/ or the edit_profile_first_name parameter to user/edit_profile. | ||
| CVE-2017-17832 | Med | 0.35 | 5.4 | 0.01 | Dec 27, 2017 | ServersCheck Monitoring Software before 14.2.3 is prone to a cross-site scripting vulnerability as user supplied-data is not validated/sanitized when passed in the settings_SMS_ALERT_TYPE parameter, and JavaScript can be executed on settings-save.html (the Settings - SMS Alerts… | ||
| CVE-2017-1365 | Med | 0.35 | 5.4 | 0.01 | Dec 27, 2017 | IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially… | ||
| CVE-2017-15312 | Med | 0.35 | 5.4 | 0.01 | Dec 22, 2017 | Huawei SmartCare V200R003C10 has a stored XSS (cross-site scripting) vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device. | ||
| CVE-2017-5258 | Med | 0.35 | 5.4 | 0.01 | Dec 20, 2017 | In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows or can guess the RW community string can provide a URL for a configuration file over SNMP with XSS strings in certain SNMP OIDs, serve it via HTTP, and the affected device will perform a… | ||
| CVE-2017-5257 | Med | 0.35 | 5.4 | 0.01 | Dec 20, 2017 | In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows (or guesses) the SNMP read/write (RW) community string can insert XSS strings in certain SNMP OIDs which will execute in the context of the currently-logged on user. | ||
| CVE-2017-5256 | Med | 0.35 | 5.4 | 0.01 | Dec 20, 2017 | In version 3.5 and prior of Cambium Networks ePMP firmware, all authenticated users have the ability to update the Device Name and System Description fields in the web administration console, and those fields are vulnerable to persistent cross-site scripting (XSS) injection. | ||
| CVE-2017-17745 | Med | 0.35 | 5.4 | 0.01 | Dec 20, 2017 | Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter. | ||
| CVE-2017-1751 | Med | 0.35 | 5.4 | 0.01 | Dec 20, 2017 | IBM Robotic Process Automation with Automation Anywhere 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a… | ||
| CVE-2017-1600 | Med | 0.35 | 5.4 | 0.01 | Dec 20, 2017 | IBM Security Guardium 10.0 Database Activity Monitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted… | ||
| CVE-2017-1494 | Med | 0.35 | 5.4 | 0.01 | Dec 20, 2017 | IBM Business Process Manager 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2017-12072 | Med | 0.35 | 5.4 | 0.01 | Dec 20, 2017 | Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbitrary web scripts or HTML via the id parameter. | ||
| CVE-2017-12630 | Med | 0.35 | 5.4 | 0.01 | Dec 18, 2017 | In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may… | ||
| CVE-2017-17694 | Med | 0.35 | 5.4 | 0.01 | Dec 15, 2017 | Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter. | ||
| CVE-2017-1546 | Med | 0.35 | 5.4 | 0.01 | Dec 13, 2017 | IBM DOORS Next Generation (DNG/RRC) 4.07, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted… |
- risk 0.35cvss 5.4epss 0.01
Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=addition_deduction request.
- risk 0.35cvss 5.4epss 0.01
Biometric Shift Employee Management System has XSS via the expense_name parameter in an index.php?user=expenses request.
- risk 0.35cvss 5.4epss 0.01
Biometric Shift Employee Management System has XSS via the index.php holiday_name parameter in an edit_holiday action.
- risk 0.35cvss 5.4epss 0.00
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter.
- risk 0.35cvss 5.4epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbitrary web script or HTML via (1) COMMAND, (2) COMMANDS INSTRUCTION, or (3) DESCRIPTION parameter.
- risk 0.35cvss 5.4epss 0.00
FS Lynda Clone has XSS via the keywords parameter to tutorial/ or the edit_profile_first_name parameter to user/edit_profile.
- risk 0.35cvss 5.4epss 0.01
ServersCheck Monitoring Software before 14.2.3 is prone to a cross-site scripting vulnerability as user supplied-data is not validated/sanitized when passed in the settings_SMS_ALERT_TYPE parameter, and JavaScript can be executed on settings-save.html (the Settings - SMS Alerts…
- risk 0.35cvss 5.4epss 0.01
IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
- risk 0.35cvss 5.4epss 0.01
Huawei SmartCare V200R003C10 has a stored XSS (cross-site scripting) vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device.
- risk 0.35cvss 5.4epss 0.01
In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows or can guess the RW community string can provide a URL for a configuration file over SNMP with XSS strings in certain SNMP OIDs, serve it via HTTP, and the affected device will perform a…
- risk 0.35cvss 5.4epss 0.01
In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows (or guesses) the SNMP read/write (RW) community string can insert XSS strings in certain SNMP OIDs which will execute in the context of the currently-logged on user.
- risk 0.35cvss 5.4epss 0.01
In version 3.5 and prior of Cambium Networks ePMP firmware, all authenticated users have the ability to update the Device Name and System Description fields in the web administration console, and those fields are vulnerable to persistent cross-site scripting (XSS) injection.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter.
- risk 0.35cvss 5.4epss 0.01
IBM Robotic Process Automation with Automation Anywhere 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
- risk 0.35cvss 5.4epss 0.01
IBM Security Guardium 10.0 Database Activity Monitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
- risk 0.35cvss 5.4epss 0.01
IBM Business Process Manager 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbitrary web scripts or HTML via the id parameter.
- risk 0.35cvss 5.4epss 0.01
In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may…
- risk 0.35cvss 5.4epss 0.01
Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.
- risk 0.35cvss 5.4epss 0.01
IBM DOORS Next Generation (DNG/RRC) 4.07, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…