CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1774 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-14415 | Med | 0.31 | 4.8 | 0.01 | Jul 29, 2019 | An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vulnerability allows a malicious VRP user to inject malicious script into another user's browser, related to resiliency plans functionality. A victim must open a… | ||
| CVE-2019-3414 | Med | 0.31 | 4.8 | 0.00 | Jul 22, 2019 | All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the… | ||
| CVE-2019-10349 | Med | 0.31 | 5.4 | 0.04 | Jul 11, 2019 | A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins. | ||
| CVE-2018-17147 | Med | 0.31 | 4.8 | 0.03 | Jul 10, 2019 | Nagios XI before 5.5.4 has XSS in the auto login admin management page. | ||
| CVE-2019-13341 | Med | 0.31 | 4.8 | 0.01 | Jul 5, 2019 | In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie. | ||
| CVE-2019-13340 | Med | 0.31 | 4.8 | 0.01 | Jul 5, 2019 | In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-13186. | ||
| CVE-2019-13339 | Med | 0.31 | 4.8 | 0.01 | Jul 5, 2019 | In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie. | ||
| CVE-2019-6639 | Med | 0.31 | 4.8 | 0.01 | Jul 3, 2019 | On BIG-IP (AFM, PEM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, an undisclosed TMUI pages for AFM and PEM Subscriber management are vulnerable to a stored cross-site scripting (XSS) issue. This is a control plane issue… | ||
| CVE-2018-16249 | — | Med | 0.31 | 4.8 | 0.01 | Jun 20, 2019 | In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an… | |
| CVE-2019-1875 | Med | 0.31 | 4.8 | 0.01 | Jun 20, 2019 | A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of… | ||
| CVE-2018-17423 | — | Med | 0.31 | 4.8 | 0.01 | Jun 19, 2019 | An issue was discovered in e107 v2.1.9. There is a XSS attack on e107_admin/comment.php. | |
| CVE-2018-19146 | Med | 0.31 | 4.8 | 0.01 | Jun 17, 2019 | Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT element. | ||
| CVE-2019-6324 | Med | 0.31 | 4.8 | 0.01 | Jun 17, 2019 | HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server potentially vulnerable to stored XSS in wireless configuration page | ||
| CVE-2019-0316 | Med | 0.31 | 4.8 | 0.01 | Jun 14, 2019 | SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by… | ||
| CVE-2018-19461 | Med | 0.31 | 4.8 | 0.01 | Jun 7, 2019 | admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php. | ||
| CVE-2019-12732 | Med | 0.31 | 4.7 | 0.01 | Jun 6, 2019 | The Chartkick gem through 3.1.0 for Ruby allows XSS. | ||
| CVE-2018-10948 | Med | 0.31 | 4.8 | 0.01 | May 30, 2019 | Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs. | ||
| CVE-2019-5932 | Med | 0.31 | 4.8 | 0.01 | May 17, 2019 | Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the application 'Portal'. | ||
| CVE-2019-3602 | Med | 0.31 | 4.8 | 0.01 | May 15, 2019 | Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) Prior to 9.1 Update 5 allows an authenticated administrator to embed an XSS in the administrator interface via a specially crafted custom rule containing HTML. | ||
| CVE-2019-6514 | — | Med | 0.31 | 4.8 | 0.01 | May 14, 2019 | An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed and executed on the same page, aka XSS. |
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vulnerability allows a malicious VRP user to inject malicious script into another user's browser, related to resiliency plans functionality. A victim must open a…
- risk 0.31cvss 4.8epss 0.00
All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the…
- risk 0.31cvss 5.4epss 0.04
A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
- risk 0.31cvss 4.8epss 0.03
Nagios XI before 5.5.4 has XSS in the auto login admin management page.
- risk 0.31cvss 4.8epss 0.01
In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie.
- risk 0.31cvss 4.8epss 0.01
In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-13186.
- risk 0.31cvss 4.8epss 0.01
In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie.
- risk 0.31cvss 4.8epss 0.01
On BIG-IP (AFM, PEM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, an undisclosed TMUI pages for AFM and PEM Subscriber management are vulnerable to a stored cross-site scripting (XSS) issue. This is a control plane issue…
- risk 0.31cvss 4.8epss 0.01
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an…
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of…
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in e107 v2.1.9. There is a XSS attack on e107_admin/comment.php.
- risk 0.31cvss 4.8epss 0.01
Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT element.
- risk 0.31cvss 4.8epss 0.01
HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server potentially vulnerable to stored XSS in wireless configuration page
- risk 0.31cvss 4.8epss 0.01
SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by…
- risk 0.31cvss 4.8epss 0.01
admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.
- risk 0.31cvss 4.7epss 0.01
The Chartkick gem through 3.1.0 for Ruby allows XSS.
- risk 0.31cvss 4.8epss 0.01
Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the application 'Portal'.
- risk 0.31cvss 4.8epss 0.01
Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) Prior to 9.1 Update 5 allows an authenticated administrator to embed an XSS in the administrator interface via a specially crafted custom rule containing HTML.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed and executed on the same page, aka XSS.