CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1641 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-25702 | Med | 0.33 | 6.1 | 0.01 | Nov 19, 2020 | In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10. | ||
| CVE-2020-28364 | Med | 0.33 | 6.1 | 0.01 | Nov 9, 2020 | A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectations by exposing this UI to outside users. | ||
| CVE-2020-26870 | Med | 0.33 | 6.1 | 0.05 | Oct 7, 2020 | Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements. | ||
| CVE-2019-20921 | Med | 0.33 | 6.1 | 0.02 | Sep 30, 2020 | bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser. | ||
| CVE-2020-25739 | Med | 0.33 | 6.1 | 0.01 | Sep 23, 2020 | An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson. | ||
| CVE-2020-23814 | Med | 0.33 | 6.1 | 0.01 | Sep 3, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file. | ||
| CVE-2020-12648 | Med | 0.33 | 6.1 | 0.02 | Aug 14, 2020 | A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode. | ||
| CVE-2020-16095 | Med | 0.33 | 6.1 | 0.01 | Jul 29, 2020 | The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS. | ||
| CVE-2020-15883 | Med | 0.33 | 6.1 | 0.01 | Jul 23, 2020 | A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported). | ||
| CVE-2019-19935 | Med | 0.33 | 6.1 | 0.02 | Jul 7, 2020 | Froala Editor before 3.2.3 allows XSS. | ||
| CVE-2020-2207 | Med | 0.33 | 6.1 | 0.01 | Jul 2, 2020 | Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability. | ||
| CVE-2020-9581 | Med | 0.33 | 6.1 | 0.01 | Jun 26, 2020 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2017-18907 | Med | 0.33 | 6.1 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header. | ||
| CVE-2016-11084 | Med | 0.33 | 6.1 | 0.00 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF. | ||
| CVE-2016-11083 | Med | 0.33 | 6.1 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window. | ||
| CVE-2016-11082 | Med | 0.33 | 6.1 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link. | ||
| CVE-2016-11079 | Med | 0.33 | 6.1 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL. | ||
| CVE-2016-11073 | Med | 0.33 | 6.1 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting. | ||
| CVE-2016-11071 | Med | 0.33 | 6.1 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place. | ||
| CVE-2016-11063 | Med | 0.33 | 6.1 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview. |
- risk 0.33cvss 6.1epss 0.01
In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.
- risk 0.33cvss 6.1epss 0.01
A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectations by exposing this UI to outside users.
- risk 0.33cvss 6.1epss 0.05
Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
- risk 0.33cvss 6.1epss 0.02
bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson.
- risk 0.33cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.
- risk 0.33cvss 6.1epss 0.02
A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.
- risk 0.33cvss 6.1epss 0.01
The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.
- risk 0.33cvss 6.1epss 0.01
A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported).
- risk 0.33cvss 6.1epss 0.02
Froala Editor before 3.2.3 allows XSS.
- risk 0.33cvss 6.1epss 0.01
Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
- risk 0.33cvss 6.1epss 0.01
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.
- risk 0.33cvss 6.1epss 0.00
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.