VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (46,607)

page 2268 of 2,331
  • CVE-2009-4459Dec 30, 2009
    Redmine
    Redmine
    risk 0.00cvss —epss 0.01

    Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which…

  • CVE-2009-4425Dec 28, 2009
    IDevCart
    iDevCart
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in iDevCart 1.09 allows remote attackers to inject arbitrary web script or HTML via the SEARCH parameter in a browse action.

  • CVE-2009-4422Dec 24, 2009
    Jpgraph
    Jpgraph
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the GetURLArguments function in jpgraph.php in Aditus Consulting JpGraph 3.0.6 allow remote attackers to inject arbitrary web script or HTML via a key to csim_in_html_ex1.php, and other unspecified vectors.

  • CVE-2009-4416Dec 24, 2009
    PhpGroupWare
    Phpgroupware
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw_" sequence.

  • CVE-2009-4408Dec 23, 2009
    Pyforum
    Pyforum
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in models.parser in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to inject arbitrary web script or HTML via crafted BBcode (1) img or (2) url tags, which are not properly handled when…

  • CVE-2009-4406Dec 23, 2009
    Apcupsd
    AP7932
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Forms/login1 in American Power Conversion (APC) Switched Rack PDU AP7932 B2, running rpdu 3.3.3 or 3.7.0 on AOS 3.3.4, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the login_username…

  • CVE-2009-3581Dec 23, 2009
    SQL Ledger
    SQL Ledger
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via (1) the DCN Description field in the Accounts Receivables menu item for Add Transaction, (2) the Description field in the Accounts…

  • CVE-2009-4400Dec 22, 2009
    TYPO3
    ste_parish_admin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Parish Administration Database (ste_parish_admin) extension 0.1.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4398Dec 22, 2009
    TYPO3
    hs_religiousartgallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Parish of the Holy Spirit Religious Art Gallery (hs_religiousartgallery) extension 0.1.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4397Dec 22, 2009
    TYPO3
    pd_resources
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Diocese of Portsmouth Resources Database (pd_resources) extension 0.1.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4395Dec 22, 2009
    TYPO3
    ste_prayer2
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Random Prayer 2 (ste_prayer2) extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4391Dec 22, 2009
    TYPO3
    dr_blob
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the File list (dr_blob) extension 2.1.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4388Dec 22, 2009
    TYPO3
    nl_listman
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the ListMan (nl_listman) extension 1.2.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4387Dec 22, 2009
    Manageengine
    Passwordmanager Pro
    risk 0.00cvss —epss 0.01

    The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Build 6104 uses case-sensitive checks for malicious inputs, which allows remote attackers to inject arbitrary web script or HTML via the…

  • CVE-2009-4379Dec 22, 2009
    Valarsoft
    Webmatic
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Valarsoft Webmatic before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2008-2924.

  • CVE-2009-4371Dec 21, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Locale module (modules/locale/locale.module) in Drupal Core 6.14, and possibly other versions including 6.15, allows remote authenticated users with "administer languages" permissions to inject arbitrary web script or HTML via the…

  • CVE-2009-4370Dec 21, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Menu module (modules/menu/menu.admin.inc) in Drupal Core 6.x before 6.15 allows remote authenticated users with permissions to create new menus to inject arbitrary web script or HTML via a menu description, which is not properly…

  • CVE-2009-4369Dec 21, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Contact module (modules/contact/contact.admin.inc or modules/contact/contact.module) in Drupal Core 5.x before 5.21 and 6.x before 6.15 allows remote authenticated users with "administer site-wide contact form" permissions to…

  • CVE-2009-4363Dec 21, 2009
    Horde (software)
    Application Framework
    risk 0.00cvss —epss 0.01

    Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 does not properly handle data: URIs, which allows remote attackers to conduct cross-site scripting (XSS) attacks…

  • CVE-2009-4352Dec 17, 2009
    Transware
    Active\! Mail
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in TransWARE Active! mail 2003 build 2003.0139.0871 and earlier, and possibly other versions before 2003.0139.0939, allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Cc, and (4) Bcc…