CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1653 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-16516 | Med | 0.33 | 6.1 | 0.01 | Sep 5, 2018 | helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL. | ||
| CVE-2018-15605 | Med | 0.33 | 6.1 | 0.02 | Aug 24, 2018 | An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature. | ||
| CVE-2018-15567 | Med | 0.33 | 6.1 | 0.01 | Aug 20, 2018 | CMSUno before 1.5.3 has XSS via the title field. | ||
| CVE-2017-12614 | Med | 0.33 | 6.1 | 0.02 | Aug 6, 2018 | It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is… | ||
| CVE-2018-14504 | Med | 0.33 | 6.1 | 0.02 | Aug 3, 2018 | An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., 'foobar"… | ||
| CVE-2018-13055 | Med | 0.33 | 6.1 | 0.02 | Aug 3, 2018 | A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO. | ||
| CVE-2016-8639 | Med | 0.33 | 6.1 | 0.01 | Aug 1, 2018 | It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface. | ||
| CVE-2018-14604 | Med | 0.33 | 6.1 | 0.01 | Jul 27, 2018 | An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur in the tooltip of the job inside the CI/CD pipeline. | ||
| CVE-2018-8031 | Med | 0.33 | 6.1 | 0.02 | Jul 23, 2018 | The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not ship with this… | ||
| CVE-2018-14042 | Med | 0.33 | 6.1 | 0.04 | Jul 13, 2018 | In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. | ||
| CVE-2018-14041 | Med | 0.33 | 6.1 | 0.04 | Jul 13, 2018 | In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. | ||
| CVE-2018-14040 | Med | 0.33 | 6.1 | 0.04 | Jul 13, 2018 | In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. | ||
| CVE-2018-11351 | Med | 0.33 | 6.1 | 0.01 | Jul 7, 2018 | script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting (XSS) vulnerabilities. These are stored within the shared files description file and allow the execution of a JavaScript payload each time an administrator searches or lists uploaded files. These… | ||
| CVE-2018-11350 | Med | 0.33 | 6.1 | 0.01 | Jul 7, 2018 | An issue was discovered in Jirafeau before 3.4.1. The file "search by name" form is affected by one Cross-Site Scripting vulnerability via the name parameter. | ||
| CVE-2018-13409 | Med | 0.33 | 6.1 | 0.01 | Jul 6, 2018 | An issue was discovered in Jirafeau before 3.4.1. The "search file by hash" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges. | ||
| CVE-2018-13408 | Med | 0.33 | 6.1 | 0.01 | Jul 6, 2018 | An issue was discovered in Jirafeau before 3.4.1. The "search file by link" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges. | ||
| CVE-2018-3769 | Med | 0.33 | 6.1 | 0.01 | Jul 5, 2018 | ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter. | ||
| CVE-2018-3748 | Med | 0.33 | 6.1 | 0.01 | Jul 3, 2018 | There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5. File name, which contains malicious HTML (eg. embedded iframe element or javascript: pseudo-protocol handler in element) allows to execute JavaScript code against any user who opens a directory… | ||
| CVE-2018-1000559 | Med | 0.33 | 6.1 | 0.01 | Jun 26, 2018 | qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This… | ||
| CVE-2018-1000534 | Med | 0.33 | 6.1 | 0.02 | Jun 26, 2018 | Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here… |
- risk 0.33cvss 6.1epss 0.01
helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.
- risk 0.33cvss 6.1epss 0.02
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.
- risk 0.33cvss 6.1epss 0.01
CMSUno before 1.5.3 has XSS via the title field.
- risk 0.33cvss 6.1epss 0.02
It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is…
- risk 0.33cvss 6.1epss 0.02
An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., 'foobar"…
- risk 0.33cvss 6.1epss 0.02
A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO.
- risk 0.33cvss 6.1epss 0.01
It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur in the tooltip of the job inside the CI/CD pipeline.
- risk 0.33cvss 6.1epss 0.02
The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not ship with this…
- risk 0.33cvss 6.1epss 0.04
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
- risk 0.33cvss 6.1epss 0.04
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
- risk 0.33cvss 6.1epss 0.04
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
- risk 0.33cvss 6.1epss 0.01
script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting (XSS) vulnerabilities. These are stored within the shared files description file and allow the execution of a JavaScript payload each time an administrator searches or lists uploaded files. These…
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in Jirafeau before 3.4.1. The file "search by name" form is affected by one Cross-Site Scripting vulnerability via the name parameter.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in Jirafeau before 3.4.1. The "search file by hash" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in Jirafeau before 3.4.1. The "search file by link" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges.
- risk 0.33cvss 6.1epss 0.01
ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.
- risk 0.33cvss 6.1epss 0.01
There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5. File name, which contains malicious HTML (eg. embedded iframe element or javascript: pseudo-protocol handler in element) allows to execute JavaScript code against any user who opens a directory…
- risk 0.33cvss 6.1epss 0.01
qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This…
- risk 0.33cvss 6.1epss 0.02
Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here…