VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (46,607)

page 2261 of 2,331
  • CVE-2010-1503Apr 23, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Google Chrome before 4.1.249.1059 allows remote attackers to inject arbitrary web script or HTML via vectors related to a chrome://net-internals URI.

  • CVE-2009-4804Apr 23, 2010
    TYPO3
    Calendar Base
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Calendar Base (cal) extension before 1.1.1 for TYPO3, when Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via "search parameters."

  • CVE-2009-4786Apr 21, 2010
    Pligg
    CMS
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Pligg before 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to (1) admin/admin_config.php, (2) admin/admin_modules.php, (3) delete.php, (4) editlink.php, (5) submit.php, (6)…

  • CVE-2009-4780Apr 21, 2010
    PhpMyAdmin
    Phpmyfaq
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter in a sitemap action, (2) the search parameter in a search action, (3) the tagging_id parameter in a…

  • CVE-2010-0997Apr 20, 2010
    E107
    E107
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in 107_plugins/content/content_manager.php in the Content Management plugin in e107 before 0.7.20, when the personal content manager is enabled, allows user-assisted remote authenticated users to inject arbitrary web script or HTML via…

  • CVE-2010-1164Apr 20, 2010
    Atlassian
    Jira
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) element or (2) defaultColor parameter to the Colour Picker page; the (3) formName parameter, (4) element parameter, or…

  • CVE-2010-1464Apr 16, 2010
    Shop Script
    Shop-Script FREE
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in WebAsyst Shop-Script FREE allow remote attackers to inject arbitrary web script or HTML via the (1) currency_id_left, (2) currency_id_right, (3) darkcolor, (4) lightcolor, (5) middlecolor, and (6) w parameters.

  • CVE-2010-1427Apr 15, 2010
    Modxcms
    Evolution
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the SearchHighlight plugin in MODx Evolution before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to AjaxSearch.

  • CVE-2010-0190Apr 14, 2010
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1371Apr 13, 2010
    Preprojects
    Pre Classified Listings Asp
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in signup.asp in Pre Classified Listings ASP allows remote attackers to inject arbitrary web script or HTML via the address parameter.

  • CVE-2010-1367Apr 13, 2010
    Uiga
    Fan Club
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/admin_login.php in Uiga Fan Club, as downloaded on 20100310, allow remote attackers to inject arbitrary web script or HTML via the (1) admin_name and (2) admin_password parameters. NOTE: the provenance of this…

  • CVE-2010-1362Apr 13, 2010
    Drupal
    Own Term
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Own Term module 6.x-1.0 for Drupal allows remote authenticated users, with "create additional terms" privileges, to inject arbitrary web script or HTML via the term description field in a term listing page.

  • CVE-2010-1358Apr 13, 2010
    Drupal
    Bibliography
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Bibliography (Biblio) module 5.x through 5.x-1.17 and 6.x through 6.x-1.9 for Drupal allows remote authenticated users, with "administer biblio" privileges, to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1357Apr 13, 2010
    Sbddirectorysoftware
    Sbd Directory Software
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in editors/logindialogue.php in SBD Directory Software 4.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2010-1355Apr 13, 2010
    Tandberg
    Video Communication Server (VCS)
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability on the TANDBERG Video Communication Server (VCS) before X5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Reference ID 66316.

  • CVE-2010-1339Apr 9, 2010
    Woltlab
    Teamsite Hack
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows remote attackers to inject arbitrary web script or HTML via the userid parameter in a modboard action, which is not properly handled in a forced…

  • CVE-2010-1333Apr 9, 2010
    Almas
    Compiere
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Almas Inc. Compiere J300_A02 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1332Apr 9, 2010
    Prettybook
    Prettyformmail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PrettyBook PrettyFormMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1303Apr 8, 2010
    Jim Berry
    Taxonomy Filter
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy Filter module 6.x before 6.x-1.1 for Drupal allow remote authenticated users, with administer taxonomy permissions or create node permissions when free tagging is enabled, to inject arbitrary web script or HTML…

  • CVE-2010-1276Apr 6, 2010
    Bbsxp
    Bbsxp
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in BBSXP 2008 SP2 allow remote attackers to inject arbitrary web script or HTML via the URI in a request to (1) AddPost.asp, (2) AddTopic.asp, (3) Admin_Default.asp, (4) Bank.asp, (5) Manage.asp, and (6) ShowPost.asp. NOTE: the…