VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (46,610)

page 2165 of 2,331
  • CVE-2014-0341Apr 15, 2014
    Pivotx
    Pivotx
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4)…

  • CVE-2014-2712Apr 14, 2014
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, and 12.2 before 12.2R1 allows remote attackers to…

  • CVE-2014-2711Apr 14, 2014
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in J-Web in Juniper Junos before 11.4R11, 11.4X27 before 11.4X27.62 (BBE), 12.1 before 12.1R9, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.2 before 12.2R7, 12.3 before 12.3R6, 13.1 before 13.1R4,…

  • CVE-2012-6131Apr 11, 2014
    Roundup Tracker
    Roundup
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1.

  • CVE-2012-6130Apr 11, 2014
    Roundup Tracker
    Roundup
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.

  • CVE-2014-2333Apr 11, 2014
    WordPress
    Lazyest Gallery
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information.

  • CVE-2013-4795Apr 11, 2014
    Reviewboard
    Reviewboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Submitters list in Review Board 1.6.x before 1.6.18 and 1.7.x before 1.7.12 allows remote attackers to inject arbitrary web script or HTML via a user full name.

  • CVE-2013-7365Apr 10, 2014
    SAP
    Enterprise Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in SAP Enterprise Portal allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2012-6132Apr 10, 2014
    Roundup Tracker
    Roundup
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.

  • CVE-2014-0331Apr 10, 2014
    Fortinet
    Fortiadc Firmware
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the web administration interface in FortiADC with firmware before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the locale parameter to gui_partA/.

  • CVE-2013-2033Apr 10, 2014
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write permission to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-0509Apr 8, 2014
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK &…

  • CVE-2014-2542Apr 8, 2014
    TIBCO Software
    Rendezvous
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Rendezvous Daemon (rvd), Rendezvous Routing Daemon (rvrd), Rendezvous Secure Daemon (rvsd), and Rendezvous Secure Routing Daemon (rvsrd) in TIBCO Rendezvous before 8.4.2, Messaging Appliance before 8.7.1, and Substation ES before…

  • CVE-2012-6645Apr 8, 2014
    Drupal
    Finder
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the autocomplete functionality in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote attackers to inject arbitrary web script or HTML via the title of a node, a different…

  • CVE-2012-6642Apr 8, 2014
    Clip Bucket
    Clipbucket
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ClipBucket 2.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter to view_channel.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2012-1561Apr 8, 2014
    Drupal
    Finder
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "checkbox and radio button…

  • CVE-2011-4958Apr 8, 2014
    Silverstripe
    Silverstripe
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders, as demonstrated by a request to (1)…

  • CVE-2012-6641Apr 7, 2014
    Prestashop
    Prestashop
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in redirect.php in the Socolissimo module (modules/socolissimo/) in PrestaShop before 1.4.7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to "parameter names and values."

  • CVE-2012-1834Apr 7, 2014
    WordPress
    CMS Tree Page View
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cms_tpv_view parameter to wp-admin/options-general.php.

  • CVE-2012-6640Apr 5, 2014
    Horde (software)
    Imp
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than…