CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,562)
page 1800 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-38063 | Med | 0.30 | 4.6 | 0.01 | Jul 12, 2023 | In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible | ||
| CVE-2023-38061 | Med | 0.30 | 4.6 | 0.01 | Jul 12, 2023 | In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible | ||
| CVE-2023-26274 | Med | 0.30 | 4.6 | 0.00 | Jun 27, 2023 | IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 248144.… | ||
| CVE-2023-34461 | Med | 0.30 | 4.6 | 0.00 | Jun 19, 2023 | PyBB is an open source bulletin board. A manual code review of the PyBB bulletin board server has revealed that a vulnerability could have been exploited in which users could submit any type of HTML tag, and have said tag run. For example, a malicious `` that looks like ```<a… | ||
| CVE-2023-35054 | Med | 0.30 | 4.6 | 0.01 | Jun 12, 2023 | In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible | ||
| CVE-2023-34229 | Med | 0.30 | 4.6 | 0.01 | May 31, 2023 | In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible | ||
| CVE-2023-34226 | Med | 0.30 | 4.6 | 0.01 | May 31, 2023 | In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible | ||
| CVE-2023-34222 | Med | 0.30 | 4.6 | 0.01 | May 31, 2023 | In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible | ||
| CVE-2023-34221 | Med | 0.30 | 4.6 | 0.01 | May 31, 2023 | In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible | ||
| CVE-2022-43871 | Med | 0.30 | 4.6 | 0.00 | Apr 29, 2023 | IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a… | ||
| CVE-2022-43914 | Med | 0.30 | 4.6 | 0.00 | Apr 7, 2023 | IBM TRIRIGA Application Platform 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2022-42452 | Med | 0.30 | 4.6 | 0.00 | Apr 2, 2023 | HCL Launch is vulnerable to HTML injection. HTML code is stored and included without being sanitized. This can lead to further attacks such as XSS and Open Redirections. | ||
| CVE-2022-48427 | Med | 0.30 | 4.6 | 0.01 | Mar 27, 2023 | In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible | ||
| CVE-2022-48429 | Med | 0.30 | 4.6 | 0.01 | Mar 27, 2023 | In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible | ||
| CVE-2022-48426 | Med | 0.30 | 4.6 | 0.01 | Mar 27, 2023 | In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible | ||
| CVE-2022-43578 | Med | 0.30 | 4.6 | 0.00 | Feb 22, 2023 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading… | ||
| CVE-2023-25928 | Med | 0.30 | 4.6 | 0.00 | Feb 21, 2023 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2022-43579 | Med | 0.30 | 4.6 | 0.00 | Feb 17, 2023 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading… | ||
| CVE-2023-23475 | Med | 0.30 | 4.6 | 0.00 | Feb 8, 2023 | IBM Infosphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2022-34362 | Med | 0.30 | 4.6 | 0.00 | Feb 8, 2023 | IBM Sterling Secure Proxy 6.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session… |
- risk 0.30cvss 4.6epss 0.01
In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible
- risk 0.30cvss 4.6epss 0.01
In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible
- risk 0.30cvss 4.6epss 0.00
IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 248144.…
- risk 0.30cvss 4.6epss 0.00
PyBB is an open source bulletin board. A manual code review of the PyBB bulletin board server has revealed that a vulnerability could have been exploited in which users could submit any type of HTML tag, and have said tag run. For example, a malicious `` that looks like ```<a…
- risk 0.30cvss 4.6epss 0.01
In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible
- risk 0.30cvss 4.6epss 0.01
In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible
- risk 0.30cvss 4.6epss 0.01
In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible
- risk 0.30cvss 4.6epss 0.01
In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible
- risk 0.30cvss 4.6epss 0.01
In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible
- risk 0.30cvss 4.6epss 0.00
IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
- risk 0.30cvss 4.6epss 0.00
IBM TRIRIGA Application Platform 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.30cvss 4.6epss 0.00
HCL Launch is vulnerable to HTML injection. HTML code is stored and included without being sanitized. This can lead to further attacks such as XSS and Open Redirections.
- risk 0.30cvss 4.6epss 0.01
In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible
- risk 0.30cvss 4.6epss 0.01
In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
- risk 0.30cvss 4.6epss 0.01
In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible
- risk 0.30cvss 4.6epss 0.00
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading…
- risk 0.30cvss 4.6epss 0.00
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.30cvss 4.6epss 0.00
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading…
- risk 0.30cvss 4.6epss 0.00
IBM Infosphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.30cvss 4.6epss 0.00
IBM Sterling Secure Proxy 6.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session…