CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1757 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-7333 | Med | 0.31 | 4.8 | 0.01 | Nov 12, 2020 | Cross site scripting vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows administrators to inject arbitrary web script or HTML via the configuration wizard. | ||
| CVE-2020-26083 | Med | 0.31 | 4.8 | 0.01 | Nov 6, 2020 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists… | ||
| CVE-2020-5932 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2020 | On BIG-IP ASM 15.1.0-15.1.0.5, a cross-site scripting (XSS) vulnerability exists in the BIG-IP ASM Configuration utility response and blocking pages. An authenticated user with administrative privileges can specify a response page with any content, including JavaScript code that… | ||
| CVE-2020-15004 | Med | 0.31 | 4.8 | 0.03 | Oct 23, 2020 | OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS. | ||
| CVE-2020-6370 | Med | 0.31 | 4.8 | 0.01 | Oct 20, 2020 | SAP NetWeaver Design Time Repository (DTR), versions - 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2020-4679 | Med | 0.31 | 4.8 | 0.01 | Oct 12, 2020 | IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:… | ||
| CVE-2020-3589 | Med | 0.31 | 4.8 | 0.01 | Oct 8, 2020 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability… | ||
| CVE-2020-17551 | Med | 0.31 | 4.8 | 0.01 | Oct 7, 2020 | ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution. | ||
| CVE-2020-13328 | Med | 0.31 | 4.8 | 0.01 | Sep 30, 2020 | An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. GitLab was vulnerable to a stored XSS by using the PyPi files API. | ||
| CVE-2019-16025 | Med | 0.31 | 4.8 | 0.01 | Sep 23, 2020 | A vulnerability in the web framework of Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of some… | ||
| CVE-2020-25124 | Med | 0.31 | 4.8 | 0.01 | Sep 3, 2020 | The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI. | ||
| CVE-2020-25123 | Med | 0.31 | 4.8 | 0.01 | Sep 3, 2020 | The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager. | ||
| CVE-2020-25122 | Med | 0.31 | 4.8 | 0.01 | Sep 3, 2020 | The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager. | ||
| CVE-2020-25121 | Med | 0.31 | 4.8 | 0.01 | Sep 3, 2020 | The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options. | ||
| CVE-2020-25120 | Med | 0.31 | 4.8 | 0.01 | Sep 3, 2020 | The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI. | ||
| CVE-2020-25119 | Med | 0.31 | 4.8 | 0.01 | Sep 3, 2020 | The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual. | ||
| CVE-2020-25118 | Med | 0.31 | 4.8 | 0.01 | Sep 3, 2020 | The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager. | ||
| CVE-2020-25117 | Med | 0.31 | 4.8 | 0.01 | Sep 3, 2020 | The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager. | ||
| CVE-2020-25116 | Med | 0.31 | 4.8 | 0.01 | Sep 3, 2020 | The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager. | ||
| CVE-2020-25115 | Med | 0.31 | 4.8 | 0.01 | Sep 3, 2020 | The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager. |
- risk 0.31cvss 4.8epss 0.01
Cross site scripting vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows administrators to inject arbitrary web script or HTML via the configuration wizard.
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists…
- risk 0.31cvss 4.8epss 0.01
On BIG-IP ASM 15.1.0-15.1.0.5, a cross-site scripting (XSS) vulnerability exists in the BIG-IP ASM Configuration utility response and blocking pages. An authenticated user with administrative privileges can specify a response page with any content, including JavaScript code that…
- risk 0.31cvss 4.8epss 0.03
OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS.
- risk 0.31cvss 4.8epss 0.01
SAP NetWeaver Design Time Repository (DTR), versions - 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- risk 0.31cvss 4.8epss 0.01
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability…
- risk 0.31cvss 4.8epss 0.01
ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.
- risk 0.31cvss 4.8epss 0.01
An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. GitLab was vulnerable to a stored XSS by using the PyPi files API.
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web framework of Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of some…
- risk 0.31cvss 4.8epss 0.01
The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.
- risk 0.31cvss 4.8epss 0.01
The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.
- risk 0.31cvss 4.8epss 0.01
The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager.
- risk 0.31cvss 4.8epss 0.01
The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.
- risk 0.31cvss 4.8epss 0.01
The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.
- risk 0.31cvss 4.8epss 0.01
The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.
- risk 0.31cvss 4.8epss 0.01
The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.
- risk 0.31cvss 4.8epss 0.01
The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.
- risk 0.31cvss 4.8epss 0.01
The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.
- risk 0.31cvss 4.8epss 0.01
The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager.