VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (46,610)

page 2190 of 2,331
  • CVE-2013-5307Aug 16, 2013
    TYPO3
    ke_search
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Faceted Search (ke_search) extension before 1.4.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5305Aug 16, 2013
    TYPO3
    Store Locator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5095Aug 16, 2013
    Juniper Networks
    Junos Space
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web-based interface in Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka PR 884469.

  • CVE-2013-4007Aug 16, 2013
    IBM
    Advanced Management Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in adv_sw.php in the Advanced Management Module (AMM) with firmware BBET before BBET64G and BPET before BPET64G for IBM BladeCenter systems allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-3034Aug 16, 2013
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the web console.

  • CVE-2013-0587Aug 16, 2013
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Portal before 8.0.0.1 CF07 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) Portal, (2) Portal 7.0.0.2, (3) Portal 8.0, or (4) PortalWeb2 theme.

  • CVE-2013-0585Aug 16, 2013
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to the (1) web console and (2) repository management…

  • CVE-2013-5300Aug 15, 2013
    Alienvault
    Open Source Security Information Management
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) before 4.3.0 allow remote attackers to inject arbitrary web script or HTML via the withoutmenu parameter to (1) vulnmeter/index.php or (2) vulnmeter/sched.php;…

  • CVE-2013-2023Aug 15, 2013
    JPlayer
    jPlayer
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different…

  • CVE-2013-1942Aug 15, 2013
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allow remote attackers to inject arbitrary web script or HTML via the (1)…

  • CVE-2013-4880Aug 14, 2013
    Bigtreecms
    Bigtree CMS
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter.

  • CVE-2013-0492Aug 9, 2013
    IBM
    Informix Open Admin Tool
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Informix Open Admin Tool (OAT) 2.x and 3.x before 3.11.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2013-5100Aug 9, 2013
    Franz Holzinger
    Static Methods
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Static Methods since 2007 (div2007) extension before 0.10.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the t3lib_div::quoteJSvalue function.

  • CVE-2012-6458Aug 9, 2013
    Silverstripe
    Silverstripe
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the SilverStripe e-commerce module 3.0 for SilverStripe CMS allow remote attackers to inject arbitrary web script or HTML via the (1) FirstName, (2) Surname, or (3) Email parameter to code/forms/OrderFormAddress.php; or the…

  • CVE-2013-5098Aug 9, 2013
    WordPress
    Download Monitor
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262.

  • CVE-2013-4600Aug 9, 2013
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to system/workplace/views/admin/admin-main.jsp or the (2) requestedResource parameter to…

  • CVE-2013-3262Aug 9, 2013
    WordPress
    Download Monitor
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter.

  • CVE-2013-3990Aug 9, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the MIME e-mail functionality in iNotes in IBM Domino 9.0 before IF3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN98FLQ2.

  • CVE-2013-3032Aug 9, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the MIME e-mail functionality in iNotes in IBM Domino 9.0 before IF3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN986NAA.

  • CVE-2013-1711Aug 7, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The XrayWrapper implementation in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 does not properly address the possibility of an XBL scope bypass resulting from non-native arguments in XBL function calls, which makes it easier for remote attackers to conduct cross-site…