CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1552 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-5181 | Med | 0.35 | 5.4 | 0.01 | Sep 25, 2017 | The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript. | ||
| CVE-2017-1424 | Med | 0.35 | 5.4 | 0.01 | Sep 25, 2017 | IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2017-14716 | Med | 0.35 | 5.4 | 0.01 | Sep 22, 2017 | In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Title parameter. | ||
| CVE-2017-14715 | Med | 0.35 | 5.4 | 0.01 | Sep 22, 2017 | In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Alerts Title parameter. | ||
| CVE-2017-14714 | Med | 0.35 | 5.4 | 0.01 | Sep 22, 2017 | In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Subject parameter. | ||
| CVE-2017-14713 | Med | 0.35 | 5.4 | 0.01 | Sep 22, 2017 | In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Description parameter. | ||
| CVE-2017-14321 | Med | 0.35 | 5.4 | 0.01 | Sep 21, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) customer name or (2) subject in a ticket. | ||
| CVE-2017-14621 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2017 | Portus 2.2.0 has XSS via the Team field, related to typeahead. | ||
| CVE-2015-1864 | Med | 0.35 | 5.4 | 0.01 | Sep 19, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details, or the (3) repository, (4) repository group, or (5) user… | ||
| CVE-2014-6191 | Med | 0.35 | 5.4 | 0.01 | Sep 19, 2017 | Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 98568. | ||
| CVE-2017-4926 | Med | 0.35 | 5.4 | 0.01 | Sep 15, 2017 | VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker with VC user privileges can inject malicious java-scripts which will get executed when other VC users access the page. | ||
| CVE-2017-1002011 | Med | 0.35 | 5.4 | 0.01 | Sep 14, 2017 | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and $value->gallery_description where anyone with privileges to modify or add galleries/images and inject javascript into the database. | ||
| CVE-2017-3165 | Med | 0.35 | 5.4 | 0.02 | Sep 13, 2017 | In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content.… | ||
| CVE-2017-13724 | Med | 0.35 | 5.4 | 0.01 | Sep 13, 2017 | On the Axesstel MU553S MU55XS-V1.14, there is a Stored Cross Site Scripting vulnerability in the APN parameter under the "Basic Settings" page. | ||
| CVE-2017-8745 | Med | 0.35 | 5.4 | 0.02 | Sep 13, 2017 | An elevation of privilege vulnerability exists in Microsoft SharePoint Foundation 2013 Service Pack 1 when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Cross Site Scripting Vulnerability". | ||
| CVE-2017-8629 | Med | 0.35 | 5.4 | 0.02 | Sep 13, 2017 | Microsoft SharePoint Server 2013 Service Pack 1 allows an elevation of privilege vulnerability when it fails to properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint XSS Vulnerability". | ||
| CVE-2017-7735 | Med | 0.35 | 5.4 | 0.01 | Sep 12, 2017 | A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.2.0 through 5.2.11 and 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via the "Groups" input while creating or editing User Groups. | ||
| CVE-2017-7734 | Med | 0.35 | 5.4 | 0.01 | Sep 12, 2017 | A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via 'Comments' while saving Config Revisions. | ||
| CVE-2015-7879 | Med | 0.35 | 5.4 | 0.01 | Sep 11, 2017 | Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page. | ||
| CVE-2017-11611 | Med | 0.35 | 5.4 | 0.01 | Sep 8, 2017 | Wolf CMS 0.8.3.1 allows Cross-Site Scripting (XSS) attacks. The vulnerability exists due to insufficient sanitization of the file name in a "create-file-popup" action, and the directory name in a "create-directory-popup" action, in the HTTP POST method to the… |
- risk 0.35cvss 5.4epss 0.01
The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.
- risk 0.35cvss 5.4epss 0.01
IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.35cvss 5.4epss 0.01
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Title parameter.
- risk 0.35cvss 5.4epss 0.01
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Alerts Title parameter.
- risk 0.35cvss 5.4epss 0.01
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Subject parameter.
- risk 0.35cvss 5.4epss 0.01
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Description parameter.
- risk 0.35cvss 5.4epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) customer name or (2) subject in a ticket.
- risk 0.35cvss 5.4epss 0.01
Portus 2.2.0 has XSS via the Team field, related to typeahead.
- risk 0.35cvss 5.4epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details, or the (3) repository, (4) repository group, or (5) user…
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 98568.
- risk 0.35cvss 5.4epss 0.01
VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker with VC user privileges can inject malicious java-scripts which will get executed when other VC users access the page.
- risk 0.35cvss 5.4epss 0.01
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and $value->gallery_description where anyone with privileges to modify or add galleries/images and inject javascript into the database.
- risk 0.35cvss 5.4epss 0.02
In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content.…
- risk 0.35cvss 5.4epss 0.01
On the Axesstel MU553S MU55XS-V1.14, there is a Stored Cross Site Scripting vulnerability in the APN parameter under the "Basic Settings" page.
- risk 0.35cvss 5.4epss 0.02
An elevation of privilege vulnerability exists in Microsoft SharePoint Foundation 2013 Service Pack 1 when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Cross Site Scripting Vulnerability".
- risk 0.35cvss 5.4epss 0.02
Microsoft SharePoint Server 2013 Service Pack 1 allows an elevation of privilege vulnerability when it fails to properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint XSS Vulnerability".
- risk 0.35cvss 5.4epss 0.01
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.2.0 through 5.2.11 and 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via the "Groups" input while creating or editing User Groups.
- risk 0.35cvss 5.4epss 0.01
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via 'Comments' while saving Config Revisions.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page.
- risk 0.35cvss 5.4epss 0.01
Wolf CMS 0.8.3.1 allows Cross-Site Scripting (XSS) attacks. The vulnerability exists due to insufficient sanitization of the file name in a "create-file-popup" action, and the directory name in a "create-directory-popup" action, in the HTTP POST method to the…