CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,562)
page 1799 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-22370 | Med | 0.30 | 4.6 | 0.00 | Jan 9, 2024 | In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible | ||
| CVE-2023-50712 | Med | 0.30 | 4.6 | 0.00 | Dec 22, 2023 | Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.3.7. The vulnerability… | ||
| CVE-2023-43057 | Med | 0.30 | 4.6 | 0.00 | Nov 11, 2023 | IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 267484. | ||
| CVE-2023-32089 | Med | 0.30 | 4.6 | 0.00 | Oct 18, 2023 | Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description | ||
| CVE-2023-32088 | Med | 0.30 | 4.6 | 0.00 | Oct 18, 2023 | Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation | ||
| CVE-2023-32087 | Med | 0.30 | 4.6 | 0.00 | Oct 18, 2023 | Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation | ||
| CVE-2023-35024 | Med | 0.30 | 4.6 | 0.00 | Oct 14, 2023 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… | ||
| CVE-2023-34977 | Med | 0.30 | 4.6 | 0.00 | Oct 13, 2023 | A cross-site scripting (XSS) vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.0 (… | ||
| CVE-2023-40684 | Med | 0.30 | 4.6 | 0.00 | Oct 4, 2023 | IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials… | ||
| CVE-2023-35905 | Med | 0.30 | 4.6 | 0.00 | Oct 4, 2023 | IBM FileNet Content Manager 5.5.8, 5.5.10, and 5.5.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted… | ||
| CVE-2023-32790 | Med | 0.30 | 4.6 | 0.00 | Oct 3, 2023 | Cross-Site Scripting (XSS) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to inject a malicious JavaScript payload into the 'Full Name' field during a user edit, due to improper sanitization of the input parameter. | ||
| CVE-2022-43909 | Med | 0.30 | 4.6 | 0.00 | Aug 27, 2023 | IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: … | ||
| CVE-2023-41248 | Med | 0.30 | 4.6 | 0.00 | Aug 25, 2023 | In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration | ||
| CVE-2023-3481 | Med | 0.30 | 5.7 | 0.00 | Aug 21, 2023 | Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension. | ||
| CVE-2023-35394 | Med | 0.30 | 4.6 | 0.01 | Aug 8, 2023 | Azure HDInsight Jupyter Notebook Spoofing Vulnerability | ||
| CVE-2023-38491 | Med | 0.30 | 5.7 | 0.01 | Jul 27, 2023 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to upload an arbitrary… | ||
| CVE-2023-39175 | Med | 0.30 | 4.6 | 0.01 | Jul 25, 2023 | In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible | ||
| CVE-2023-25929 | Med | 0.30 | 4.6 | 0.00 | Jul 22, 2023 | IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2023-38066 | Med | 0.30 | 4.6 | 0.01 | Jul 12, 2023 | In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads | ||
| CVE-2023-38065 | Med | 0.30 | 4.6 | 0.01 | Jul 12, 2023 | In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible |
- risk 0.30cvss 4.6epss 0.00
In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible
- risk 0.30cvss 4.6epss 0.00
Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.3.7. The vulnerability…
- risk 0.30cvss 4.6epss 0.00
IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 267484.
- risk 0.30cvss 4.6epss 0.00
Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description
- risk 0.30cvss 4.6epss 0.00
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation
- risk 0.30cvss 4.6epss 0.00
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation
- risk 0.30cvss 4.6epss 0.00
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
- risk 0.30cvss 4.6epss 0.00
A cross-site scripting (XSS) vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.0 (…
- risk 0.30cvss 4.6epss 0.00
IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…
- risk 0.30cvss 4.6epss 0.00
IBM FileNet Content Manager 5.5.8, 5.5.10, and 5.5.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
- risk 0.30cvss 4.6epss 0.00
Cross-Site Scripting (XSS) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to inject a malicious JavaScript payload into the 'Full Name' field during a user edit, due to improper sanitization of the input parameter.
- risk 0.30cvss 4.6epss 0.00
IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: …
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration
- risk 0.30cvss 5.7epss 0.00
Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension.
- risk 0.30cvss 4.6epss 0.01
Azure HDInsight Jupyter Notebook Spoofing Vulnerability
- risk 0.30cvss 5.7epss 0.01
Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to upload an arbitrary…
- risk 0.30cvss 4.6epss 0.01
In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible
- risk 0.30cvss 4.6epss 0.00
IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.30cvss 4.6epss 0.01
In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads
- risk 0.30cvss 4.6epss 0.01
In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible