VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (46,607)

page 2229 of 2,331
  • CVE-2012-1004Feb 8, 2012
    Foswiki
    Foswiki
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in UI/Register.pm in Foswiki before 1.1.5 allow remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via the (1) text, (2) FirstName, (3) LastName, (4) OrganisationName, (5) OrganisationUrl,…

  • CVE-2012-1020Feb 8, 2012
    NexorONE
    Online Banking
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in login.php in NexorONE Online Banking allow remote attackers to inject arbitrary web script or HTML via the (1) visitor_language parameter to register.php or (2) message parameter.

  • CVE-2012-1019Feb 8, 2012
    Cryptpad
    XWiki Enterprise
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in XWiki Enterprise 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) XWiki.XWikiComments_comment parameter to xwiki/bin/commentadd/Main/WebHome, (2) XWiki.XWikiUsers_0_company parameter when editing…

  • CVE-2011-4511Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and…

  • CVE-2011-4510Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and…

  • CVE-2012-0979Feb 2, 2012
    TWiki
    Twiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in TWiki allows remote attackers to inject arbitrary web script or HTML via the organization field in a profile, involving (1) registration or (2) editing of the user.

  • CVE-2012-0976Feb 2, 2012
    Silverstripe
    Silverstripe
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter. NOTE: some of these details are obtained from third party…

  • CVE-2012-0975Feb 2, 2012
    Clixint
    Image Hosting Script Dpi
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in misc.php in Image Hosting Script DPI 1.0, 1.3, and earlier allows remote attackers to inject arbitrary web script or HTML via the showseries parameter.

  • CVE-2012-0446Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to inject arbitrary web script or HTML via a (1) web page or (2) Firefox extension, related to improper…

  • CVE-2012-0782Jan 30, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor…

  • CVE-2012-0936Jan 29, 2012
    Opennms
    Opennms
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via the Username…

  • CVE-2011-5070Jan 29, 2012
    Support Incident Tracker
    SiT!
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to inject arbitrary web script or HTML via (1) the file name to incident_attachments.php; (2) unspecified vectors in link_add.php, possibly involving origref,…

  • CVE-2011-3830Jan 29, 2012
    Sitracker
    Support Incident Tracker
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.php in Support Incident Tracker (aka SiT!) 3.65 allows remote attackers to inject arbitrary web script or HTML via the search_string parameter.

  • CVE-2012-0312Jan 26, 2012
    OsCommerce
    Oscommerce
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce Online Merchant before 2.3.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-0311Jan 26, 2012
    OsCommerce
    Oscommerce
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-1940Jan 26, 2012
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to (1)…

  • CVE-2012-0919Jan 24, 2012
    Hitachi
    It Operations Director
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 through 03-00-04, and possibly other versions before 03-00-06, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-0917Jan 24, 2012
    Hitachi
    It Operations Analyzer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Analyzer 02-01, 02-51 through 02-51-01, and 02-53 through 02-53-02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-0914Jan 24, 2012
    Drupal
    Panels
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in display_renderers/panels_renderer_editor.class.php in the admin view in the Panels module 6.x-2.x before 6.x-3.10 and 7.x-3.x before 7.x-3.0 for Drupal allows remote authenticated users with certain privileges to inject arbitrary web…

  • CVE-2012-0909Jan 24, 2012
    Horde (software)
    Groupware Webmail Edition
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Horde_Form in Horde Groupware Webmail Edition before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to email verification. NOTE: Some of these details are obtained from third…