CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1650 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-14013 | Med | 0.33 | 6.1 | 0.07 | May 29, 2019 | Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients. | ||
| CVE-2016-10245 | Med | 0.33 | 6.1 | 0.02 | May 24, 2019 | Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection. | ||
| CVE-2019-12313 | Med | 0.33 | 6.1 | 0.01 | May 24, 2019 | XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element. | ||
| CVE-2019-10076 | Med | 0.33 | 6.1 | 0.05 | May 20, 2019 | A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. | ||
| CVE-2019-12043 | Med | 0.33 | 6.1 | 0.01 | May 13, 2019 | In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL. | ||
| CVE-2018-19048 | Med | 0.33 | 6.1 | 0.02 | May 13, 2019 | Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element. | ||
| CVE-2019-11818 | Med | 0.33 | 6.1 | 0.01 | May 8, 2019 | Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp). This allows an attacker to insert arbitrary JavaScript as user input (First Name or Last Name), which will be… | ||
| CVE-2015-9286 | Med | 0.33 | 6.1 | 0.01 | Apr 30, 2019 | Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS. | ||
| CVE-2018-15584 | Med | 0.33 | 6.1 | 0.01 | Apr 26, 2019 | Cross-Site Scripting (XSS) vulnerability in adm/boardgroup_form_update.php and adm/boardgroup_list_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2018-15582 | Med | 0.33 | 6.1 | 0.01 | Apr 26, 2019 | Cross-Site Scripting (XSS) vulnerability in adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2018-15581 | Med | 0.33 | 6.1 | 0.01 | Apr 26, 2019 | Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2018-15580 | Med | 0.33 | 6.1 | 0.01 | Apr 26, 2019 | Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2019-11454 | Med | 0.33 | 6.1 | 0.02 | Apr 22, 2019 | Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is… | ||
| CVE-2019-6796 | Med | 0.33 | 6.1 | 0.01 | Apr 11, 2019 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 2 of 2). The user status field contains a lack of input validation and output encoding that results in a persistent XSS. | ||
| CVE-2019-11004 | Med | 0.33 | 6.1 | 0.01 | Apr 8, 2019 | In Materialize through 1.0.0, XSS is possible via the Toast feature. | ||
| CVE-2019-10260 | Med | 0.33 | 6.1 | 0.01 | Mar 28, 2019 | Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format). | ||
| CVE-2018-15585 | Med | 0.33 | 6.1 | 0.02 | Mar 27, 2019 | Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter. | ||
| CVE-2018-19644 | Med | 0.33 | 5.0 | 0.01 | Mar 27, 2019 | Reflected cross site script issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. | ||
| CVE-2016-10744 | Med | 0.33 | 6.1 | 0.02 | Mar 27, 2019 | In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data. | ||
| CVE-2019-3826 | Med | 0.33 | 6.1 | 0.03 | Mar 26, 2019 | A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary… |
- risk 0.33cvss 6.1epss 0.07
Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.
- risk 0.33cvss 6.1epss 0.02
Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.
- risk 0.33cvss 6.1epss 0.01
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.
- risk 0.33cvss 6.1epss 0.05
A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
- risk 0.33cvss 6.1epss 0.01
In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.
- risk 0.33cvss 6.1epss 0.02
Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.
- risk 0.33cvss 6.1epss 0.01
Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp). This allows an attacker to insert arbitrary JavaScript as user input (First Name or Last Name), which will be…
- risk 0.33cvss 6.1epss 0.01
Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
- risk 0.33cvss 6.1epss 0.01
Cross-Site Scripting (XSS) vulnerability in adm/boardgroup_form_update.php and adm/boardgroup_list_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
- risk 0.33cvss 6.1epss 0.01
Cross-Site Scripting (XSS) vulnerability in adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
- risk 0.33cvss 6.1epss 0.01
Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
- risk 0.33cvss 6.1epss 0.01
Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
- risk 0.33cvss 6.1epss 0.02
Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is…
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 2 of 2). The user status field contains a lack of input validation and output encoding that results in a persistent XSS.
- risk 0.33cvss 6.1epss 0.01
In Materialize through 1.0.0, XSS is possible via the Toast feature.
- risk 0.33cvss 6.1epss 0.01
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
- risk 0.33cvss 6.1epss 0.02
Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
- risk 0.33cvss 5.0epss 0.01
Reflected cross site script issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
- risk 0.33cvss 6.1epss 0.02
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
- risk 0.33cvss 6.1epss 0.03
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary…