VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (46,610)

page 2191 of 2,331
  • CVE-2013-1709Aug 7, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly handle the interaction between FRAME elements and history, which allows remote attackers to conduct cross-site…

  • CVE-2013-3995Aug 6, 2013
    IBM
    Infosphere Biginsights
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM InfoSphere BigInsights 1.1 through 2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-4676Aug 5, 2013
    Symantec
    Backup Exec
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a (1) custom-reports generation page, (2) Storage Devices creation page,…

  • CVE-2012-5460Aug 1, 2013
    Juniper Networks
    Ive OS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the help page in Juniper Secure Access (SA) with IVE OS before 7.1r13, 7.2.x before 7.2r7, and 7.3.x before 7.3r2 allows remote attackers to inject arbitrary web script or HTML via the WWHSearchWordsText parameter.

  • CVE-2013-4670Aug 1, 2013
    Symantec
    Web Gateway
    risk 0.00cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-4674Jul 31, 2013
    Symantec
    Pgp Universal Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec PGP Universal Server) before 3.3.0 MP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted encrypted…

  • CVE-2013-2630Jul 31, 2013
    Ca
    Service Desk Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in CA Service Desk Manager 12.5 through 12.7 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2013-2209Jul 31, 2013
    Reviewboard
    Reviewboard
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.

  • CVE-2013-5002Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted pageNumber value to schema_export.php.

  • CVE-2013-5001Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php in phpMyAdmin 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted object name associated with a…

  • CVE-2013-4997Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (aka chart title)…

  • CVE-2013-4996Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted database name, (2) a crafted user name, (3) a crafted logo URL in the…

  • CVE-2013-4995Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is not properly handled during the display of row information.

  • CVE-2013-4954Jul 29, 2013
    WordPress
    Pie Register
    risk 0.00cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the…

  • CVE-2013-4140Jul 29, 2013
    Drupalisme
    Tinybox
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the TinyBox (Simple Splash) module before 7.x-2.2 for Drupal allows remote authenticated users with the "administer tinybox" permission to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-4944Jul 29, 2013
    WordPress
    BuddyPress Extended Friendship Request
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the BuddyPress Extended Friendship Request plugin before 1.0.2 for WordPress, when the "Friend Connections" component is enabled, allows remote attackers to inject arbitrary web script or HTML via the friendship_request_message…

  • CVE-2013-2181Jul 29, 2013
    Mw Wp Form Project
    Monkey
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Directory Listing plugin in Monkey HTTP Daemon (monkeyd) 1.2.2 allows attackers to inject arbitrary web script or HTML via a file name.

  • CVE-2013-4942Jul 29, 2013
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote…

  • CVE-2013-4941Jul 29, 2013
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to…

  • CVE-2013-4940Jul 29, 2013
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary…