VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,541)

page 2053 of 2,428
  • CVE-2011-5179Sep 20, 2012
    Skysa
    Skysa App Bar Integration Plugin
    risk 0.04cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in skysa-official/skysa.php in Skysa App Bar Integration plugin, possibly before 1.04, for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter.

  • CVE-2012-4889Sep 10, 2012
    Manageengine
    Firewallanalyzer
    risk 0.04cvss —epss 0.08

    Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) subTab or (2) tab parameter to createAnomaly.do; (3) url, (4) subTab, or (5) tab parameter to mindex.do; (6) tab…

  • CVE-2012-4600Aug 31, 2012
    OTRS
    Otrs
    risk 0.04cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.14, 3.0.x before 3.0.16, and 3.1.x before 3.1.10, when Firefox or Opera is used, allows remote attackers to inject arbitrary web script or HTML via an e-mail message body…

  • CVE-2011-4926Aug 29, 2012
    WordPress
    Adminimize
    risk 0.04cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2011-5107Aug 23, 2012
    WordPress
    Alert Before You Post
    risk 0.04cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in post_alert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter.

  • CVE-2011-5106Aug 23, 2012
    WordPress
    Flexible Custom Post Type
    risk 0.04cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2012-1835Aug 14, 2012
    WordPress
    All-in-One Event Calendar
    risk 0.04cvss —epss 0.09

    Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4)…

  • CVE-2012-2371Aug 13, 2012
    WordPress
    WP-FaceThumb
    risk 0.04cvss —epss 0.13

    Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pagination_wp_facethumb parameter.

  • CVE-2012-2577Aug 12, 2012
    SolarWinds
    Orion Network Performance Monitor
    risk 0.04cvss —epss 0.10

    Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName field of an snmpd.conf file.

  • CVE-2012-0389Jan 24, 2012
    MailEnable
    Mailenable
    risk 0.04cvss —epss 0.08

    Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4.26 and earlier, 5.x before 5.53, and 6.x before 6.03 allows remote attackers to inject arbitrary web script or HTML via the Username parameter.

  • CVE-2012-0901Jan 20, 2012
    WordPress
    YouSayToo
    risk 0.04cvss —epss 0.07

    Cross-site scripting (XSS) vulnerability in yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter.

  • CVE-2012-0007Jan 10, 2012
    Microsoft
    AntiXSS Library
    risk 0.04cvss —epss 0.19

    The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the detection of a Cascading Style Sheets (CSS) escaped character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML input, aka…

  • CVE-2011-0962May 20, 2011
    Cisco Systems, Inc.
    Unified Operations Manager
    risk 0.04cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in the Common Services Device Center in Cisco Unified Operations Manager (CUOM) before 8.6 allows remote attackers to inject arbitrary web script or HTML via the tag parameter, aka Bug…

  • CVE-2010-2091May 27, 2010
    Microsoft
    Outlook Web Access
    risk 0.04cvss —epss 0.18

    Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct…

  • CVE-2009-4142Dec 21, 2009
    PHP
    PHP
    risk 0.04cvss —epss 0.07

    The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte…

  • CVE-2009-1879Aug 21, 2009
    Adobe Inc.
    Flex
    risk 0.04cvss —epss 0.08

    Cross-site scripting (XSS) vulnerability in index.template.html in the express-install templates in the SDK in Adobe Flex before 3.4, when the installed Flash version is older than a specified requiredMajorVersion value, allows remote attackers to inject arbitrary web script or…

  • CVE-2009-1872Aug 18, 2009
    Adobe Inc.
    Coldfusion
    risk 0.04cvss —epss 0.16

    Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2)…

  • CVE-2009-2350Jul 7, 2009
    Microsoft
    Internet Explorer
    risk 0.04cvss —epss 0.14

    Microsoft Internet Explorer 6.0.2900.2180 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the…

  • CVE-2009-1201Jun 25, 2009
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.04cvss —epss 0.09

    Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by…

  • CVE-2009-1684Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via an event handler that triggers script execution in the…