VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,544)

page 2268 of 2,428
  • CVE-2013-6047Feb 25, 2014
    Ikiwiki Hosting Project
    Ikiwiki Hosting
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the site creation interface in ikiwiki-hosting before 0.20131025 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-0861Feb 22, 2014
    IBM
    Cognos Business Intelligence
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an…

  • CVE-2014-0811Feb 22, 2014
    Blackboard
    Vista\/ce
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Blackboard Vista/CE 8.0 SP6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6732Feb 22, 2014
    IBM
    Cognos Business Intelligence
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an…

  • CVE-2014-1879Feb 20, 2014
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.

  • CVE-2014-0081Feb 20, 2014
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2)…

  • CVE-2014-0735Feb 20, 2014
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum46470.

  • CVE-2014-2018Feb 17, 2014
    Mozilla Corporation
    Thunderbird
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in a (1)…

  • CVE-2013-1070Feb 17, 2014
    Ubuntu
    Metal As A Service
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the API in Ubuntu Metal as a Service (MaaS) 1.2 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the op parameter to nodes/.

  • CVE-2013-7326Feb 14, 2014
    Vtiger
    vTiger
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) return_url parameter to modules\com_vtiger_workflow\savetemplate.php, or unspecified vectors to (2) deletetask.php, (3) edittask.php, (4)…

  • CVE-2013-7032Feb 14, 2014
    Livezilla
    Livezilla
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the web based operator client in LiveZilla before 5.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name of an uploaded file or (2) customer name in a resource created from an uploaded file, a…

  • CVE-2013-4499Feb 14, 2014
    Drupal
    Bean
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Bean module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via the bean title.

  • CVE-2014-0814Feb 14, 2014
    PhpMyAdmin
    Phpmyfaq
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-0332Feb 14, 2014
    SonicWall
    Analyzer
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in mainPage in Dell SonicWALL GMS before 7.1 SP2, SonicWALL Analyzer before 7.1 SP2, and SonicWALL UMA E5000 before 7.1 SP2 might allow remote attackers to inject arbitrary web script or HTML via the node_id parameter in a…

  • CVE-2014-1965Feb 14, 2014
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors…

  • CVE-2014-1964Feb 14, 2014
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error.

  • CVE-2013-4415Feb 14, 2014
    Red Hat
    Satellite
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) whereCriteria variable in a software channels search; (2) end_year, (3) start_hour, (4) end_am_pm,…

  • CVE-2013-1871Feb 14, 2014
    Red Hat
    Satellite
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in account/EditAddress.do in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter.

  • CVE-2012-6149Feb 14, 2014
    Red Hat
    Satellite
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in systems/sdc/notes.jsp in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) subject or (2) content values of a note in a system.addNote XML-RPC call.

  • CVE-2013-6743Feb 14, 2014
    IBM
    Sametime
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving an IMG element.