CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1651 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-15583 | Med | 0.33 | 6.1 | 0.01 | Mar 25, 2019 | Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter. | ||
| CVE-2019-7608 | Med | 0.33 | 6.1 | 0.01 | Mar 25, 2019 | Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. | ||
| CVE-2019-10010 | Med | 0.33 | 6.1 | 0.01 | Mar 24, 2019 | Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than… | ||
| CVE-2019-8426 | Med | 0.33 | 6.1 | 0.01 | Feb 18, 2019 | skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter. | ||
| CVE-2019-8425 | Med | 0.33 | 6.1 | 0.01 | Feb 18, 2019 | includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages. | ||
| CVE-2019-8400 | Med | 0.33 | 6.1 | 0.01 | Feb 17, 2019 | ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter. | ||
| CVE-2015-9282 | Med | 0.33 | 6.1 | 0.01 | Feb 6, 2019 | The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard. | ||
| CVE-2018-20757 | Med | 0.33 | 6.1 | 0.01 | Feb 6, 2019 | MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name. | ||
| CVE-2018-20756 | Med | 0.33 | 6.1 | 0.01 | Feb 6, 2019 | MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs. | ||
| CVE-2018-20755 | Med | 0.33 | 6.1 | 0.01 | Feb 6, 2019 | MODX Revolution through v2.7.0-pl allows XSS via the User Photo field. | ||
| CVE-2019-7413 | Med | 0.33 | 6.1 | 0.01 | Feb 5, 2019 | In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via the title text. ("parallax" has a spelling change within the PHP filename.) | ||
| CVE-2019-7324 | Med | 0.33 | 6.1 | 0.01 | Feb 4, 2019 | app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting. | ||
| CVE-2019-6992 | Med | 0.33 | 6.1 | 0.01 | Jan 28, 2019 | A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a long NAME or PROTOCOL to the index.php?view=controlcaps URI. | ||
| CVE-2019-6802 | Med | 0.33 | 6.1 | 0.04 | Jan 25, 2019 | CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI. | ||
| CVE-2019-6777 | Med | 0.33 | 6.1 | 0.01 | Jan 24, 2019 | An issue was discovered in ZoneMinder v1.32.3. Reflected XSS exists in web/skins/classic/views/plugin.php via the zm/index.php?view=plugin pl parameter. | ||
| CVE-2017-1002152 | Med | 0.33 | 6.1 | 0.01 | Jan 10, 2019 | Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles. | ||
| CVE-2018-1000416 | Med | 0.33 | 6.1 | 0.01 | Jan 9, 2019 | A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access. | ||
| CVE-2018-1000407 | Med | 0.33 | 6.1 | 0.02 | Jan 9, 2019 | A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins. | ||
| CVE-2018-20677 | Med | 0.33 | 6.1 | 0.04 | Jan 9, 2019 | In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property. | ||
| CVE-2018-20676 | Med | 0.33 | 6.1 | 0.04 | Jan 9, 2019 | In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute. |
- risk 0.33cvss 6.1epss 0.01
Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
- risk 0.33cvss 6.1epss 0.01
Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than…
- risk 0.33cvss 6.1epss 0.01
skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter.
- risk 0.33cvss 6.1epss 0.01
includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages.
- risk 0.33cvss 6.1epss 0.01
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.
- risk 0.33cvss 6.1epss 0.01
The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard.
- risk 0.33cvss 6.1epss 0.01
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.
- risk 0.33cvss 6.1epss 0.01
MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.
- risk 0.33cvss 6.1epss 0.01
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.
- risk 0.33cvss 6.1epss 0.01
In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via the title text. ("parallax" has a spelling change within the PHP filename.)
- risk 0.33cvss 6.1epss 0.01
app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting.
- risk 0.33cvss 6.1epss 0.01
A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a long NAME or PROTOCOL to the index.php?view=controlcaps URI.
- risk 0.33cvss 6.1epss 0.04
CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in ZoneMinder v1.32.3. Reflected XSS exists in web/skins/classic/views/plugin.php via the zm/index.php?view=plugin pl parameter.
- risk 0.33cvss 6.1epss 0.01
Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles.
- risk 0.33cvss 6.1epss 0.01
A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access.
- risk 0.33cvss 6.1epss 0.02
A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins.
- risk 0.33cvss 6.1epss 0.04
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
- risk 0.33cvss 6.1epss 0.04
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.